GitHub adds 48-hour expiry for unvalidated npm trusted publishing

GitHub closed a supply chain loophole in npm by making unvalidated trusted publishing configurations expire after 48 hours. The flaw, found by Bloom Security on June 6, 2026, let attackers claim abandoned repository slugs and publish malicious package updates. Over 1,500 vulnerable packages with 10 million downloads were identified.

• Unvalidated npm trusted publishing settings now expire after 48 hours
• Flaw let attackers claim abandoned repository slugs and publish packages
• Over 1,500 vulnerable packages with 10 million downloads found
• npm rejects requests from certain automated code comment processes