GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation, The Hacker News reported. The change follows research finding that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. The report states that the flaw left more than 1,500 packages vulnerable to hijacking. According to the excerpt, GitHub said, "Your configuration becomes validated and exempt from expiry after its first successful publish." The publication describes GitHub as a Microsoft-owned subsidiary. The excerpt does not detail the mechanics of the flaw, the identity of the researchers, the specific packages affected, or any additional remediation beyond the expiry behavior for unvalidated configurations.
Unvalidated npm trusted publishing configurations now expire after 48 hours, a change prompted by a flaw that left over 1,500 packages open to hijacking.