GitHub Introduces npm Security with Stronger Authentication and Trusted Publishing

GitHub has announced significant npm security updates aimed at tightening authentication methods, introducing short‑lived tokens and trusted publishing to safeguard the software supply chain. In mid-September 2025, a self‑replicating worm known as the Shai‑Hulud attack infiltrated multiple popular JavaScript packages, hijacking maintainer accounts to inject harmful post‑install scripts that could steal secrets and propagate further.

According to GitHub, maintainers removed over 500 compromised packages from the registry and blocked uploads containing known indicators of compromise. The changes include requiring two‑factor authentication for all local package publishing, with maintainers using FIDO‑based WebAuthn rather than traditional time‑based one‑time passwords. npm will also adopt granular access tokens with a maximum lifetime of seven days, deprecating legacy classic tokens and removing bypass options for 2FA during local publishing.

Additionally, trusted publishing—pioneered by PyPI in April 2023 and extending to other ecosystems—uses identity providers and OpenID Connect to verify trusted workflows, enabling tokenless releases from pipelines where possible.