🧰 npm OIDC trusted publishing

The items that name it 2

• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeup2026-10-12It is written here as npm OIDC trusted publishing (short-lived publish tokens via per-run JWT exchange).

  short-lived publish tokens via per-run JWT exchange

• Nx Console VS Code Extension Compromised
  writeup2026-06-02

  Legitimate npm feature abused via stolen OIDC tokens to exchange for publishing credentials with valid provenance