Oct 142026 GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking GitHub now expires unvalidated npm trusted publisher bindings after 48 hours to limit package hijacks through reclaimed repository names.
