GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken action to address a vulnerability in npm publishing by expiring unvalidated trusted publishing configurations after 48 hours. This move comes after researchers discovered that an attacker could push new versions of a package belonging to another user without needing their credentials. To avoid expiry, a configuration must be validated through a successful publish, which occurs after the first use. This change aims to prevent package hijacking, a issue that had left over 1,500 packages vulnerable. GitHub's new policy is designed to enhance security for npm package publishers. The policy is now in effect for all users.