npm lifts its one-config limit on trusted publishing per package
Packages can now register independent OIDC publishers per repo, workflow, and environment, retiring the long-lived tokens OIDC couldn't cover before.
Copy markdown
One config was the bottleneck
npm allowed a single trusted-publishing (OIDC) config per package, so teams juggling stable, prerelease, and staging releases fell back on workflow hacks or a long-lived token. That token was the weakest link in the supply chain.
Now the configs are additive
Register as many as you need; each is independent, with its own repository, workflow, and environment criteria. That means publishing the same package from different repos and CI pipelines without a single shared credential.
Everything is staged by default
Every new config publishes to a staging area first — direct-to-registry is opt-in per config. It puts an approval gate between npm publish and the version actually going live for installs.
Delete your last publish token
If you kept an automation token only for the one release path OIDC couldn't reach, you can now retire it. Fewer long-lived secrets sitting in CI is one less thing to leak in a supply-chain attack.
It stacks on npm's 2026 hardening
This lands on top of publish-time malware scanning and staged publishing npm shipped earlier this year, tightening the path from commit to installable package. Configure it in your package settings on npmjs.com.