A four-month-old npm trust flaw left 1,500 packages open to hijack
Security firm Bloom Security disclosed SlugFest, a way to inherit npm publishing rights via an abandoned GitHub repository name. GitHub fixed it on 2 October.
Bloom Security disclosed on 13 October a flaw it calls SlugFest in npm’s Trusted Publishing feature, the mechanism that lets a GitHub Actions workflow publish a package without a stored npm token. Trusted Publishing trusted a repository by its human-readable slug, owner/repo, rather than its permanent numeric ID. If a maintainer renamed, transferred or deleted a repository before its first publish, the old slug became free for anyone to claim, register a matching workflow filename, and request an OIDC token to publish under the original package’s name. No stolen credentials required.
Bloom found over 1,500 npm packages exposed this way, with more than 10 million downloads between them. Bloom reported the flaw to GitHub on 6 June, GitHub validated it on 9 June, and a fix shipped on 2 October: unvalidated Trusted Publishing configurations now expire 48 hours after creation, and a configuration only becomes permanent after its first successful publish. Bloom says it separately caught and blocked a customer’s AI coding agent trying to install one of the exposed packages, and that it has not confirmed the flaw was exploited before the fix went live.
Why it matters: if you publish via Trusted Publishing, GitHub’s fix is already live, but check your own configuration was validated with a real publish rather than left pending. A stale, unvalidated entry is exactly what this attack needed.