The September attack on npm showed that the JavaScript ecosystem is vulnerable. Attackers are increasingly targeting popular packages, because they can be used to "get into" thousands of projects. GitHub, as the owner of npm, did not wait for the next crisis and introduced new protection mechanisms.
The most notable of them are trusted publishing and advanced checks when publishing packages.
What is trusted publishing?
Trusted publishing is a new model for publishing packages in npm that eliminates the need to store and use secret tokens. Instead, you can now publish packages directly, trusting GitHub Actions or another CI/CD provider.
No tokens — nothing to leak.
Binding the publication to the repository, and therefore to a specific code.
Simple setup: GitHub confirms authorship and “signs” the package.
New checks when publishing
Package owner verification - publication is possible only by confirmed participants.
Verification of the source code — the link between the source code and the package becomes more transparent.
Logging and auditing — now it is easier to track who exactly launched the publication and what code was the basis.
Why is this important to everyone?
It may seem that the changes only affect the maintainers of large libraries, but this is not the case.
For application developers: less chance of getting an infected package.
For library authors: no need to store tokens that can be stolen.
For companies: a transparent audit process and more confidence in the security of the supply chain.
Comparison of the old and new npm publication process
Stage | Earlier (before trusted publishing) | Now (with trusted publishing) |
|---|---|---|
Authentication | Secret npm tokens, manual or CI storage. | No tokens needed: GitHub Actions confirms authorship. |
Safety | High risk of token leakage. | No tokens — nothing to leak, the publication is tied to the code. |
Transparency | It is difficult to link the release to the code. | Automatic verification: the package is linked to the source code. |
Audit | Manual checks. | Detailed publication logs. |
Setting | Manual creation and storage of tokens. | One-time trusted publishing setup. |
Trusted publishing process diagram
flowchart TD
A[Разработчик пушит код в GitHub] --> B[Запуск GitHub Actions workflow]
B --> C[Сборка и тесты проекта]
C --> D[GitHub подтверждает авторство и репозиторий]
D --> E[Trusted Publishing: передача данных в npm]
E --> F[npm получает пакет]
F --> G[Верификация пакета и исходников]
G --> H[Успешная публикация в npm Registry]
What developers should do right now
Check the repository on GitHub and access to settings.
Enable GitHub Actions, if you are not already using CI/CD.
Configure trusted publishing in npm: link the package to the repository.
Delete old tokensto reduce the risk of leaks.
Update documentation, indicating that the publication is through trusted publishing.
GitHub is taking the right step: ecosystem vulnerabilities cannot be solved by the “manual discipline” of developers alone. Automatic and built-in protection is required. Trusted publishing and new checks are not just a convenience, but a fundamental shift towards a safe and trusted ecosystem.
Code helps beginners and experienced developers to understand modern tools and work more safely.
Subscribe to our blog and Telegram channelto keep up to date with new technologies.