GITHUB has tightened its npm trusted publishing rules after researchers exposed a flaw tied to repository name reuse. A new requirement means that a trusted publishing configuration must complete its first successful publish within 48 hours of creation; if it does not, the configuration will fail and can no longer publish packages.
The change directly targets a flaw where an attacker could exploit a repository name rebound to bypass a package maintainer’s credentials and push malicious versions to an existing npm package.
The attack relies on npm trusted publishing, which uses short-lived OIDC tokens so GitHub Actions can publish packages without long-lived tokens. The vulnerability arises because, before the first successful publish, the system relies mainly on the GitHub repository owner/repo name and the workflow file name rather than the repository’s immutable identity.
If a maintainer renames, transfers, or deletes a repository, the old name may become available again; an attacker could register the same name, create a matching workflow, and obtain publishing credentials to release a malicious version under the original package name. Researchers estimate the impact could affect more than 1,500 npm packages with over 10 million downloads.
In response, GitHub clarified the 48-hour binding window and rolled out restrictions on certain publishing events, encouraging publishers to switch to safer triggers such as push, release, or workflow_dispatch.