corpus.blog
41,554 blogs · 5,063,431 posts Claim your blog
Record · corpus.blog/posts/01a0fab0-76ee-71a6-bcb7-2592e19d5d9f

Publishing npm and PyPI Packages Without Long-Lived Tokens - Trusted Publishing, Staged Publishing, and What Trusted Publishing Does Not Assert | hidekazu-konishi.com

hidekazu-konishi.com · published 1 October 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at hidekazu-konishi.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
51
Words captured
15,940

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://docs.npmjs.com/trusted-publishers
docs.npmjs.com
https://docs.npmjs.com/staged-publishing
docs.npmjs.com
https://docs.npmjs.com/generating-provenance-statements
docs.npmjs.com
https://docs.npmjs.com/viewing-package-provenance
docs.npmjs.com
https://docs.npmjs.com/about-access-tokens
docs.npmjs.com
https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification
docs.npmjs.com
https://docs.npmjs.com/about-registry-signatures
docs.npmjs.com
https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow
docs.npmjs.com
https://docs.npmjs.com/cli/v12/commands/npm-stage
docs.npmjs.com
https://docs.npmjs.com/cli/v12/commands/npm-trust
docs.npmjs.com
https://docs.npmjs.com/cli/v12/commands/npm-publish
docs.npmjs.com
https://api-docs.npmjs.com/
api-docs.npmjs.com
https://github.blog/changelog/2023-04-19-npm-provenance-public-beta/
github.blog
https://github.blog/changelog/2023-07-26-publishing-with-npm-provenance-from-private-source-repositories-is-no-longer-supported/
github.blog
https://github.blog/changelog/2023-09-26-npm-provenance-general-availability/
github.blog
https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
github.blog
https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
github.blog
https://github.blog/changelog/2025-11-05-npm-security-update-classic-token-creation-disabled-and-granular-token-changes/
github.blog
https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/
github.blog
https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
github.blog
https://github.blog/changelog/2026-04-06-npm-trusted-publishing-now-supports-circleci/
github.blog
https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/
github.blog
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/
github.blog
https://github.blog/changelog/2026-06-25-npm-adds-preventive-account-protection-for-high-impact-accounts/
github.blog
https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/
github.blog
https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/
github.blog
https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens/
github.blog
https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm/
github.blog
https://github.blog/changelog/2026-09-09-npm-extends-recovery-code-security-holds-to-all-accounts/
github.blog
https://github.blog/changelog/2026-09-18-stage-only-npm-tokens-for-safer-automation/
github.blog
https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing/
github.blog
Our plan for a more secure npm supply chain Read at the source ↗
github.blog
https://docs.pypi.org/trusted-publishers/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/adding-a-publisher/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/using-a-publisher/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/security-model/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/troubleshooting/
docs.pypi.org
https://docs.pypi.org/trusted-publishers/internals/
docs.pypi.org
https://docs.pypi.org/attestations/
docs.pypi.org
https://docs.pypi.org/attestations/producing-attestations/
docs.pypi.org
https://docs.pypi.org/attestations/consuming-attestations/
docs.pypi.org
https://docs.pypi.org/attestations/security-model/
docs.pypi.org
https://docs.pypi.org/attestations/publish/v1/
docs.pypi.org
Token Exfiltration Campaign via GitHub Actions Workflows Read at the source ↗
blog.pypi.org
Trusted Publishing is popular, now for GitLab Self-Managed and Organizations Read at the source ↗
blog.pypi.org
Incident Report: LiteLLM/Telnyx supply-chain attacks, with guidance Read at the source ↗
blog.pypi.org
Releases now reject new files after 14 days Read at the source ↗
blog.pypi.org
https://peps.python.org/pep-0740/
peps.python.org
https://peps.python.org/pep-0694/
peps.python.org
https://docs.github.com/en/actions/reference/security/oidc
docs.github.com
Elsewhere on hidekazu-konishi.com (10)
Software Supply Chain Security on AWS - Signing, Attestation, and Admission Control | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
Hardening GitHub Actions for AWS Deployments - Workflow Permissions, Untrusted Triggers, Action Pinning, and What the Trust Policy Cannot Catch | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
Major Security Vulnerabilities History and Timeline - Disclosure, Impact, and the Response Practices They Changed | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
CI/CD Tools History and Timeline - Trademarks, Acquisitions, Foundations, and Where the Build Runs | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
AWS IAM Inbound Workload Federation - IAM Roles Anywhere, OIDC, and SPIFFE Converging on One Trust Policy Condition | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
Passkeys and WebAuthn in Practice - Discoverable Credentials, Synced Versus Device-Bound Keys, and Why Account Recovery Decides the Design | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
Agent Skills Security Vetting Guide - Static Inspection of SKILL.md and Malicious Skill Patterns | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
EC2 Image Builder - Recipes, Workflows, Distribution, and Lifecycle Policies, and What the Image Resource Records About How an AMI Was Built | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
LLM Evaluation Harness Settings Behind a Benchmark Score - Prompt Format, Few-Shot Examples, Answer Extraction, Agent Sandboxes, and What to Disclose Alongside the Number | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com
Hidekazu Konishi - Profile / Biography | hidekazu-konishi.com Read at the source ↗
hidekazu-konishi.com