# GitHub limits unvalidated npm publishing trust to 48 hours

_Published Tuesday, October 13, 2026 at 1:07 PM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![GitHub limits unvalidated npm publishing trust to 48 hours — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3aDWaWT6PmRDL9d6tHPDisxclb_Ak7YZIxuS02EUFvNaWrc4_UKwUqW0RI1KT3r8zsneOguD6b85yg8mf3gAzZZOGuLi-mXckG_yzwmXXb3IchTBSVeRvPlUo7QU4Kp4yiM6QqPshmo4p0GQ55XZPTEDc0DZn9N84S_ZibZ4rkXuhZ3OvoHNCYH-wk0k-/s1700-nu-rw-lo-l85-e365/git-npm.jpg)

GitHub has imposed a 48-hour expiry on unvalidated npm trusted publishing configurations after researchers found a way to publish versions of other users' packages without stealing credentials. A first successful publish validates the configuration and binds it to the repository's permanent identity.

Before that first publish, npm trusted a repository's name, allowing an attacker to claim an abandoned name and inherit its publishing authority. Bloom Security said it found over 1,500 vulnerable packages with more than 10 million collective downloads.

Npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events. Changing a repository or project identity requires a fresh trust relationship and validation window.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html)

---
Canonical: https://techandbusiness.org/newswire/7rLNjDa5TAnRo3irYs5EBG
Published: 2026-10-13T17:07:55.624Z
Story chronology: 2026-10-13T16:18:18.000Z
Retrieved: 2026-10-13T19:59:36.634Z
Publisher: Tech & Business (techandbusiness.org)