Unvalidated npm trusted publishing configurations now expire
By Steven Van ·
A successful publish within 48 hours exempts a configuration from expiry, while npm also blocks tokens from issue_comment events.
npm trusted publishing configurations must complete a successful publish within 48 hours of creation to remain usable. GitHub says the change limits the risk of trusting a repository or project name that changes ownership.
Validation and expiry
The first successful publish validates a configuration and exempts it from expiry. Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window. Ordinary edits do not restart the deadline.
Expired configurations can no longer authorize publishing. To start another 48-hour window, recreate the configuration. Expired entries remain visible in trusted publisher settings but do not count toward per-package limits. Other valid configurations on the package are unaffected.
Restricted workflow events
npm now also rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target restriction. Affected workflows need to move publishing to a permitted event such as push, release, or workflow_dispatch.
Read the original announcement.
