Trusted Publishing

Trusted publishing is a way to publish packages to a registry such as npm or PyPI from a CI/CD workflow without a stored API token: the workflow presents a short-lived OpenID Connect (OIDC) identity token from its CI provider, and the registry exchanges it for a short-lived publish credential if it matches a publisher configuration the maintainer registered.

On PyPI the resulting API token is valid for 15 minutes; npm supports GitHub Actions, GitLab CI/CD and CircleCI (npm CLI 11.5.1 or later) and adds provenance attestations automatically for public packages published from GitHub or GitLab. It removes the long-lived publish token that worms such as Shai-Hulud harvest from laptops and CI, but the trust is only as good as the identifier the configuration binds to. In October 2026 Bloom Security's SlugFest research showed npm matched repositories by owner and name until the first publish, so anyone who reclaimed a renamed or deleted repository name could mint publish credentials for more than 1,500 packages. Maintainers should publish once right after creating a binding, review bindings after any rename or transfer, and remove them before deleting a repository.

See also: workload identity federation, OIDC, secrets in repositories and CI, Shai-Hulud reaches the Tensorlake npm SDK