Building on feedback from the npm maintainer community, GitHub has made three capabilities for npm publishing generally available, each designed to streamline the trusted publishing experience while reinforcing security practices.

  • Multiple trusted publishing configurations per package
  • Staged packages can only be approved after malware scanning is complete
  • Maintainers can see their staged history in the package versions tab

Multiple OIDC Configurations Per Package

Packages can now support multiple trusted publishing (OIDC) configurations, eliminating the previous one-per-package limitation. This change allows maintainers to establish separate workflows for stable releases, prerelease versions, and staging environments without resorting to workarounds or maintaining long-lived tokens for scenarios outside OIDC's scope.

Each configuration operates independently and additively, with distinct repository, workflow, and environment parameters. Maintainers can add, list, and remove configurations through their package settings. A publish or stage request receives authorization whenever an incoming OIDC token matches any single configuration. Since configurations do not restrict each other and evaluation order carries no guarantees, workflows should not depend on which specific configuration validates a request.

Staging and Malware Scanning Integration

All trusted publishing configurations default to staging capability, while direct publishing requires explicit opt-in on a per-configuration basis. GitHub recommends keeping configurations limited to staging only, as this approach introduces a human approval checkpoint before versions reach the registry, preventing compromised workflows from publishing directly.

Following the introduction of publish-time malware scanning, packages undergo scanning before becoming available. Within the staged publishing queue, the approval button now remains disabled during scanning and activates once the scan finishes. The interface refreshes status information every minute.

Staged History Visibility

The versions tab on npmjs.com now displays a comprehensive history accessible to respective maintainers for each version, documenting whether it received approval, rejection, or remains in staged status.