Post

There is no Trusted Publishing setup which prevents a compromised repo admin's github PAT from triggering an npm publish, right? I've spent months trying to find something, but deploy envs w/ required reviews, workflow guards, branch protections, signed tags. All of it can be overwritten w/o 2fa

7/5/26, 10:34 pm0 reposts4 likes

jonchurch

@jonchurch.com

7 May

I am still hopeful I am wrong! But I think it's a "fox in the hen house" situation, and gating TP inside github cannot guard against admins getting their github cli token slurped up.

You are not wrong.

There is a fundamental flaw at the foundation of the security model on which this is built. Trying to escape these fundamentals is like trying to break the laws of physics. No matter how cool it seems for that sci-fi book to propose a world where things are different, it’s just not true in this one.