GitHub Adds Multiple Trusted Publishing Configurations for npm Packages

What shipped

GitHub rolled out three improvements to npm trusted publishing on September 3, 2026: multiple OIDC configurations per package, staged packages that block approval until malware scanning finishes, and a staged history view on the package versions tab.

What changed

Packages can now have more than one trusted publishing (OIDC) configuration — one for stable releases, another for prereleases, another for staging. Each configuration has its own repository, workflow, and environment criteria. An incoming OIDC token is authorized if it matches any one configuration.

Every configuration can stage a package by default; direct publishing is opt-in per configuration. Staged publishing now waits for malware scanning to complete before the approval button activates. Maintainers can also review their staged history from the package versions tab, replacing the old flow where staging state was opaque.

Why a builder cares

If you maintain an npm package, you no longer need long-lived tokens or workflow workarounds to separate stable, prerelease, and staging pipelines. The malware-scan gate reduces the risk of publishing compromised code, and the staged history gives you an audit trail without leaving the npm UI.