Summary
On September 3, 2026, GitHub made three npm publishing updates generally available, led by support for multiple trusted publishing (OIDC) configurations per package. Maintainers can now cover stable, prerelease, and staging workflows with independent, additive OIDC configs instead of relying on long-lived tokens.
What changed
A package can now have more than one trusted publishing (OIDC) configuration, each independent and additive with its own repository, workflow, and environment criteria. GitHub also made staged packages approvable only after malware scanning completes, and added a staged-history view in the package versions tab.
Why it matters
Long-lived npm tokens are a recurring supply-chain attack vector. Allowing multiple OIDC configs per package lets maintainers keep tokenless, workflow-scoped publishing across stable, prerelease, and staging paths, closing a gap that previously forced token workarounds — a growing concern as AI- and agent-generated packages increase publish volume.
Evidence excerpt
"A package can now have more than one trusted publishing (OIDC) configuration ... Each configuration is independent and additive, with its own repository, workflow, and environment criteria." Staged packages can only be approved after malware scanning completes, and maintainers can see staged history in the package versions tab.