npm trusted publishing now allows multiple OIDC configurations per package and blocks approval until malware scanning finishes

GitHub Changelog·medium signalXBlueskyLinkedInCopy link

GitHub made three npm publishing changes generally available on 2026-09-03. Packages can hold more than one trusted publishing configuration instead of a single setup, each operating independently with direct publishing opt-in per configuration. The staged-package approval button is now disabled while a scan is still running and only enables once it completes, and the versions tab on npmjs.com shows whether each version was approved, rejected, or is still staged. GitHub recommends staging-only, since it inserts a human approval step before a version goes live.