🧰 npm trusted publishing

The items that name it 4

• Supply Chain Attack targeting Cline installs OpenClaw | Endor Labs
  writeup2026-10-12It is written here as npm trusted publishing (short-lived OIDC tokens from GitHub or GitLab; publishes labelled on npmjs.org).

  short-lived OIDC tokens from GitHub or GitLab; publishes labelled on npmjs.org

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeup2026-08-28

  Publishing mechanism using id-token: write / GitHub Actions OIDC that the attacker abused to publish packages without a maintainer npm password or long lived token

• Shai-Hulud was the best thing to happen to supply chain security
  article2026-08-24

  Replaces long-lived npm API tokens with short-lived, per-run credentials issued via OpenID Connect (OIDC), made Generally Available July 2025; recommended fix against token theft

• npm now freezes high-impact accounts after risky account changes
  article2026-06-26

  Removes long-lived tokens by authenticating publishing through short-lived OIDC credentials scoped to a CI workflow, so there's no long-standing token for a RAT to steal.