New stricter rules from GitHub for code packages after security investigation

GitHub has introduced stricter rules for code packages following a security investigation, implementing a 48-hour expiration window for unvalidated npm trusted publishing configurations. This update aims to close a supply chain loophole that allowed attackers to exploit abandoned repository slugs and publish package updates without proper credentials.

The vulnerability was identified by security firm Bloom Security, who discovered that GitHub's system relied on the name of the address rather than a permanent digital identifier, making it possible for skilled attackers to claim abandoned repository slugs and publish malicious changes to software they did not own. As a result, GitHub has decided that trust settings that have not been validated with a successful publish will automatically expire within 48 hours of their creation.

To address this issue, software creators are advised to check the settings of trusted connections, delete and recreate links if repositories are renamed or moved, and monitor for any unexpected posts.

Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.