GitHub, npm Deploy Staged Publishing and Short-Lived Tokens to Thwart Supply Chain Attacks
New security measures target the CI/CD token theft vector behind the TeamPCP campaign and GitHub breach.
GitHub and npm have rolled out security enhancements designed to disrupt the automation pipelines attackers exploit to inject malicious code into widely used packages. The updates, announced in late May 2026, follow the TeamPCP supply chain campaign that compromised the Nx Console VS Code extension and led to the exfiltration of approximately 3,800 internal GitHub repositories.
Staged Publishing Requires Human Approval
The centerpiece is staged publishing, which became generally available on May 22, 2026. npm CLI version 11.15.0 introduced commands that let maintainers stage a package release and require human two-factor authentication approval before it goes live. The workflow uses `npm stage publish` to prepare a release, followed by `npm stage approve` or `npm stage reject` to finalize or block it.
This human-in-the-loop gate directly addresses the attack vector TeamPCP (also tracked as UNC6780) exploited: stolen CI/CD tokens that allowed automated malicious publishing without maintainer knowledge. GitHub's security team noted the feature is optional, giving maintainers the choice to adopt it based on their risk profile.
Granular Tokens Replace Long-Lived Secrets
Write-enabled granular access tokens now enforce two-factor authentication by default and carry a maximum lifetime of 90 days, with a default expiration of seven days. This represents a significant shift from classic npm tokens that had no expiration and broad permissions.
The changes build on a November 2025 security update that disabled classic token creation entirely. Maintainers migrating to granular tokens gain the ability to scope permissions to specific packages and repositories, limiting the blast radius if credentials are compromised.
Trusted Publishing Eliminates Tokens Entirely
For CI/CD pipelines, GitHub is promoting Trusted Publishing, which uses OpenID Connect to authenticate package publishes without storing any long-lived secrets. Under this model, GitHub Actions can obtain short-lived OIDC tokens that npm verifies directly, removing the need for maintainers to store npm tokens in their workflow configurations.
"The goal is to eliminate the primary automation vector attackers use to scale their campaigns," a GitHub spokesperson said in a blog post detailing the changes.
The Threat That Drove the Changes
The urgency behind these updates stems from a surge in supply chain attacks targeting the trust developers place in established libraries. TeamPCP's campaign compromised more than 500 npm packages by stealing CI/CD credentials and publishing trojanized versions. The Nx Console breach in May 2026 demonstrated the stakes: attackers gained access to GitHub's internal repository cache, exposing thousands of private codebases.
Security researchers noted that once an attacker obtains a valid token, they can publish malicious versions that automatically propagate to downstream projects.
What Maintainers Should Do Now
Package maintainers are encouraged to migrate to granular tokens immediately, enable two-factor authentication on all accounts with publishing rights, and consider adopting staged publishing for high-value packages. Organizations using GitHub Actions should evaluate Trusted Publishing to remove stored secrets from their pipelines entirely.
The changes represent the most significant overhaul to npm's security model in years, shifting from a trust-but-verify approach to one that assumes credentials will be compromised and builds controls to limit damage.