· adswds-team · Security · 2 min read
npm trusted publishing’s 48-hour rule: what CI must change after slug reuse
Landian News: GitHub requires first successful publish within 48 hours for new npm Trusted Publishing configs, closing a repo-name reuse (SlugFest) window; issue_comment tokens are rejected. Tighten ad/landing release pipelines accordingly.
According to Landian News (14 Oct 2026), GitHub changed npm Trusted Publishing: a new trust config that does not complete a first successful publish within 48 hours expires and can no longer publish. The change targets repository-name reuse—after rename/transfer/delete, the old owner/repo slug may reopen; an attacker registering the same name with a matching workflow could obtain publish rights before the config binds to an immutable repo identity. npm also rejects trusted-publishing tokens from GitHub Actions issue_comment events (alongside prior pull_request_target limits).
In one line: OIDC “no long-lived token” does not mean “trust configs can hang unused forever.”
1. What was fixed
| Item | Detail (via Landian / public changelog) |
|---|---|
| Risk | Before first publish, trust mostly checked readable slug + workflow filename, not immutable repo ID |
| Attack | Abandoned slug claimed → matching Actions → malicious version on victim package |
| Fix | Unvalidated configs must succeed within 48h; then bind immutable identity; ordinary edits don’t reset clock |
| Identity change | New trust + new 48h window |
| Events | Prefer push / release / workflow_dispatch |
Trusted Publishing rose after worms like Shai-Hulud / TeamPCP. This patch shows automation trust anchors must resist recyclable names.
2. CI checklist for ad landings
- Inventory Trusted Publishing packages (landing UI, shared libs, Worker tooling);
- After creating a config, complete a real publish inside 48h;
- Triggers exclude
issue_comment/ risky PR events; - Plan repo renames/transfers with rebuilt trust—not fire drills;
- Recreate expired configs; “still visible” ≠ “still valid”;
- Keep lockfile checks, least privilege, dual publish review.
The same day, Landian also covered a Docker Hub account-to-org PAT mishandling bug—same theme: publish-identity lifecycle when org shape changes.
3. Relation to traffic work
A poisoned front-end package can rewrite redirects and steal click IDs. Entry filtering will not save a dirty build from your own CI.
Visitor rules structure traffic; Trusted Publishing discipline keeps the build yours.
4. Takeaways
Landian’s 48-hour rule turns open-ended trust setup into time-boxed activation. Audit Trusted Publishing and Actions triggers this week before a rename/transfer window becomes a slug-reuse incident.
Further reading: TeamPCP undercover & rotation, axios hijack.
