Provenance Attestations

GitHub Tightens npm Publishing Security with 2FA, Short-Lived Tokens and Trusted Publishing

News, Policy, Privacy, Risk, Vulnerabilities

September 23, 2025

GitHub announced a sweeping set of security measures for npm publishing, including deprecating legacy tokens, migrating to FIDO-based 2FA, and introducing seven-day, short-lived granular tokens plus trusted publishing that uses OpenID Connect and cryptographic provenance attestations to bolster npm’s supply-chain security.