# Multiple trusted publishing configurations for npm

By Steven Van · 2026-09-03

We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback.

Npm packages hosted via [GitHub](<https://creatorstoolbox.com/tools/github>) can now have more than one trusted publishing (OIDC) configuration. Maintainers were previously limited to one configuration per package, which meant relying on workflow workarounds or a long-lived token to cover paths OIDC couldn't reach, such as separate stable, prerelease, or staging release flows. Each configuration is independent and additive, with its own repository, workflow, and environment criteria, and can be added, listed, or removed from the package's settings page. A publish or stage is authorized if the incoming token matches any one configuration; GitHub notes that evaluation order isn't guaranteed, so configurations shouldn't be treated as having priority over one another.

Two related changes ship alongside this, detailed in the [announcement](<https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm>):

- In the staged publishing queue, the approval button is now disabled until malware scanning finishes, and becomes available once the scan completes. The queue page refreshes status every minute.

- The versions tab on npmjs.com now shows maintainers a detailed history for each version, including whether it was approved, rejected, or is still staged.

[![](<https://github.blog/wp-content/uploads/2026/09/645960197-3267bb1c-c3c3-4827-af05-a0635a8a43b7.jpg>)](<https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm>)

![GitHub](<https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png>)

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

[View GitHub →](<https://creatorstoolbox.com/tools/github>)

[Original source](<https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm>)

[Read Multiple trusted publishing configurations for npm on Creators Toolbox](<https://creatorstoolbox.com/blog/github-multiple-trusted-publishing-configurations-for-npm>)

---
Canonical source: https://creatorstoolbox.com/blog/github-multiple-trusted-publishing-configurations-for-npm