GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Consider Adopting NPM Trusted Publishing · Issue #1978 · microsoftgraph/msgraph-sdk-javascript

Consider Adopting NPM Trusted Publishing #1978

New issue
Copy link
New issue
Copy link
Open
Open
Consider Adopting NPM Trusted Publishing#1978
Copy link
Labels
status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned

Description

@Cevan00
Chase N (Cevan00)
opened on Oct 2, 2025
Issue body actions

Overview

Recent supply chain attacks on npm have highlighted the need for stronger package publishing security. The September 2025 Shai-Hulud worm compromised 500+ packages through stolen maintainer tokens, showing the risks of token-based publishing.

Trusted publishing helps by eliminating long-lived tokens that can be stolen or accidentally exposed; generating automatic provenance provides cryptographic proof of where/how packages are built; and is an industry standard adopted by PyPI, RubyGems, crates.io, NuGet, etc...

NPM is planning to deprecate legacy tokens and make trusted publishing the preferred method.

Reference

References:

  • NPM trusted publishing documentation
  • Announcement blog post
  • Provenance statements guide

Inspiration:

  • Consider adopting npm trusted publishing microsoft/TypeScript#62499

Activity

  1. Chase N (Cevan00)
    added
    status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned
    on Oct 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    status:waiting-for-triageAn issue that is yet to be reviewed or assignedAn issue that is yet to be reviewed or assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.