GitHub adds expiry rule for npm publishing setups after takeover flaw

First reported by Cyber Security News at · Updated · 2 sources

A flaw in npm Trusted Publishing exposed more than 1,500 packages to possible takeover. According to The Hacker News, GitHub now expires unvalidated publishing configurations after 48 hours, while a first successful publish exempts them from expiry. Cyber Security News reports that attackers could exploit reclaimed GitHub repository names.

  • Cyber Security News says affected packages collectively had more than 10 million downloads.

Covered by 2 publishers within 5 hours of the first report.

Reporting2

Cyber Security News npm Trusted Publishing Flaw With 10 Million Downloads Exposes 1,500+ Packages to Malicious Takeover · Tushar Subhra Dutta
The Hacker News GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking · info@thehackernews.com (The Hacker News)