GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has tightened npm publishing by expiring unvalidated trusted publishing configurations 48 hours after creation, following a flaw that left over 1,500 packages vulnerable to hijacking. The vulnerability allowed attackers to push new versions of another user's package without credentials. Configurations become validated and exempt from expiry after the first successful publish, enhancing security for the npm ecosystem.