GitHub Implements npm Package Publishing Security Measures Following Critical Vulnerability Discovery

GitHub has introduced a 48-hour expiration for unvalidated npm publishing configurations to mitigate a vulnerability that allowed attackers to hijack packages without credentials. The measure aims to prevent unauthorized version uploads by ensuring configurations are validated before becoming permanent.

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials.

"Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary

Read original article