npm adds multiple trusted publishing configurations, improves security for staged releases
npm has launched three generally available updates to trusted publishing, designed to enhance security and flexibility for maintainers. Packages can now support multiple OIDC configurations, removing the previous limitation to one per package and simplifying complex release workflows. Additionally, approval for staged packages is now contingent on the completion of malware scans, preventing immediate release of potentially compromised versions. Maintainers also gain increased visibility into their staged publishing processes through a new detailed history view in the package versions tab.
- →Support for multiple trusted publishing configurations per npm package
- →View detailed staged publishing history for npm packages
- →Staged npm packages require malware scan completion before approval
Features (2) ›
- Support for multiple trusted publishing configurations per npm package
npm packages can now have more than one trusted publishing (OIDC) configuration, allowing maintainers to separate workflows for stable, prerelease, or staging versions without relying on workarounds. Each configuration is independent and additive, authorized if the incoming OIDC token matches any one configuration.
- View detailed staged publishing history for npm packages
Maintainers can now view a detailed history for each package version directly in the npmjs.com versions tab. This new visibility includes the status of staged packages, showing whether a version was approved, rejected, or is still awaiting staging.
Enhancements (1) ›
- Staged npm packages require malware scan completion before approval
For staged npm packages, the approval button in the publishing queue is now disabled until the publish-time malware scan has successfully completed. This ensures that a human approval step is only possible after security checks have passed, preventing immediate release of compromised workflows.
https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm
Related releases
- GitHub Actions Adds New API, Permissions, and Workflow Context Properties GitHub Changelog ·
- GitHub CLI Linux package signing key expires September 5, 2026 GitHub Changelog ·
- GitHub Copilot to Deprecate Selected AI Models by October 2026 GitHub Changelog ·
- Gemini 3.8 Flash Now Available in GitHub Copilot GitHub Changelog ·
- GitHub Reopens Copilot Business & Enterprise Sign-ups with Billing Updates GitHub Changelog ·
- CodeQL 2.26.4 Enhances GitHub Actions Security Detections and Language Support GitHub Changelog ·