GitHub Enforces 48‑Hour Expiry on npm Trusted Publishing to Curb Package Hijacking

GitHub has introduced a 48‑hour expiration policy for unvalidated npm trusted publishing configurations. The update follows a Bloom Security discovery that attackers could hijack thousands of packages by pushing new releases without stealing credentials.

What Happened

Researchers found that an attacker could create a trusted publisher configuration for any repository and, if the configuration remained unvalidated for more than 48 hours, push a malicious package version. GitHub now automatically expires such bindings after two days unless a successful publish occurs first.

Impact

More than 1,500 npm packages were left exposed by the flaw. The vulnerability enabled supply‑chain attacks where a compromised package could be used to inject malicious code into downstream projects.

What to Do

• Audit all npm trusted publishing configurations in your organization.
• Ensure each configuration has completed a successful publish within 48 hours of creation.
• Re‑validate any bindings that have expired or are pending validation.
• Restrict trusted publishing tokens from GitHub Actions issue_comment events and enforce the pull_request_target restriction.
• Implement monitoring for unexpected new package releases from your repositories.

Mitigation Steps

“Your configuration becomes validated and exempt from expiry after its first successful publish.” – GitHub

To mitigate future risk, bind trusted publishers to the repository’s immutable identity, review ownership changes, and consider disabling trusted publishing for repositories that are frequently transferred or renamed.