GitHub Expires Unvalidated npm Trusted Publishing Configurations to Prevent Package Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. The Microsoft-owned subsidiary stated that "Your configuration becomes validated and exempt from expiry after its first successful publish." This defensive configuration change was implemented following the discovery that the trusted publishing feature, intended to allow maintainers to publish packages from CI systems without exposing credentials, could be abused. Attackers could potentially exploit expired or unvalidated configurations to hijack packages and distribute malicious versions. The automatic expiry mechanism forces repository owners to re-validate their trusted publishing settings, thereby closing the hijacking vector. The change affects the npm registry and GitHub Packages, impacting the broader Microsoft ecosystem supply chain. No specific CVE has been assigned to this configuration change, which is described as a defensive hardening measure rather than a patch for a software vulnerability.