npm gains multiple trusted publishing configurations

GitHub announced on September 3 that npm packages can have multiple OIDC trusted-publishing configurations. Each configuration is independent: publishing is authorized if it matches any one of them. The change allows different workflows without relying on a single configuration.

For maintainers of libraries or modding tools, that brings publishing closer to a project’s actual organization. Prerelease and stable versions can follow separate paths. The important distinction is that several permissions do not create a barrier requiring every condition to match: the announced configurations are alternatives.

Our editorial suggestion is to map which repositories, workflows and environments genuinely need publishing access. Give each path an understandable name and remove configurations that no longer serve a purpose. A clear history helps explain where a version came from when something goes wrong.

We did not configure package publishing for this report. The update can make a process easier to trace, but it does not make every workflow trustworthy by definition. Read the documentation and test the intended path with a prerelease first. The goal is less improvisation and a clear understanding of who can publish to the registry.

Sources: GitHub. Checked September 10, 2026. Document-based reporting; no hands-on test.