Multiple trusted publishing configurations for npm

npm's trusted publishing (OIDC) now supports multiple configurations per package, letting maintainers set separate rules for stable, prerelease, or staging workflows without relying on long-lived tokens or workarounds. Each configuration is independent and additive, and a publish or stage succeeds if the incoming OIDC token matches any configuration. Staged packages can now only be approved after malware scanning completes, with the approval button disabled during scanning and status refreshing every minute. The npmjs.com versions tab also now shows maintainers a detailed staged history, including approval, rejection, or staged status for each version.

Source: https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.