TechCapsules

AI-summarised brief · reviewed before publication

GitHub has introduced a 48‑hour expiration for new npm trusted publishing configurations after Bloom Security revealed a flaw that allowed attackers to hijack packages by claiming abandoned repository slugs. The change requires a successful publish within two days to validate the configuration and bind it to the repository’s immutable ID. It also blocks trusted publishing tokens from GitHub Actions issue_comment events and enforces the pull_request_target restriction. The update follows a June 6 report that exposed a potential supply‑chain attack affecting over 1,500 packages.