Multiple trusted publishing configurations for npm
npm now supports multiple trusted publishing configurations for a single package. This update allows maintainers to define multiple OIDC-based publishing workflows for one npm package.
Verified State Diff
Impact & Verification Analysis
npm package maintainers, DevOps engineers, and organizations managing automated CI/CD release pipelines.
It eliminates the need for long-lived npm access tokens, significantly reducing the risk of credential leakage and simplifying the management of complex, multi-environment release workflows.
Full Fact Overview
This update expands the OpenID Connect (OIDC) integration for npm, which previously restricted packages to a single trusted publishing configuration. By allowing multiple configurations, maintainers can now delegate publishing permissions to different environments, CI/CD pipelines, or external services without sharing long-lived npm tokens. This architectural shift moves npm closer to a zero-trust security model by enabling granular, identity-based authentication for package releases.