Critical npm Trusted Publishing Flaw Exposes Over 1,500 Packages to Hijacking
Researchers at Bloom Security uncovered a critical vulnerability in npm’s Trusted Publishing mechanism, dubbed SlugFest, which could allow attackers to hijack legitimate software packages by exploiting abandoned GitHub repository names. The flaw stemmed from npm’s reliance on human-readable repository names rather than immutable numeric IDs to verify trusted publishers, enabling attackers to claim a renamed or deleted repository and inherit its publishing privileges.
The attack required no compromise of the original maintainer’s GitHub or npm accounts. In controlled testing, Bloom successfully published a malicious version of an existing npm package by registering a reclaimed repository name and configuring a GitHub Actions workflow with the expected filename. If exploited in the wild, a hijacked package could execute attacker-controlled code during installation, particularly through installation hooks or AI-driven dependency selection, where agents automatically pull packages without explicit developer approval.
Bloom’s registry-wide scan identified over 1,500 vulnerable npm packages, including security tools, authentication libraries, and cryptographic modules, with a combined 10 million+ downloads and 1+ million monthly downloads. One package alone accounted for 200,000 monthly downloads. The researchers also found that AI agents which increasingly automate package installations amplify the risk, as they may unknowingly introduce compromised dependencies.
npm addressed the issue on October 2 by implementing a 48-hour expiry for unvalidated Trusted Publishing configurations and blocking tokens issued via GitHub Actions’ issue_comment and pull_request_target events. While no active exploitation has been observed, maintainers were advised to audit their Trusted Publishing bindings and verify that repository names still resolve to controlled accounts.
The flaw highlights the growing threat of supply-chain attacks via automated dependency management, where malicious packages no longer need to trick developers only AI agents.
npm, Inc. cybersecurity rating report: https://www.rankiteo.com/company/npm-inc-
"id": "NPM1791887085",
"linkid": "npm-inc-",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '10 million+ downloads (1+ '
'million monthly downloads)',
'industry': 'Software Development',
'name': 'npm',
'type': 'Package Registry'},
{'customers_affected': '1+ million monthly downloads '
'(200,000 for one package alone)',
'industry': 'Various',
'name': 'Affected npm package maintainers',
'type': 'Software Developers/Organizations'}],
'attack_vector': 'Exploitation of abandoned GitHub repository names',
'date_resolved': '2023-10-02',
'description': 'Researchers at Bloom Security uncovered a critical '
'vulnerability in npm’s Trusted Publishing mechanism, dubbed '
'SlugFest, which could allow attackers to hijack legitimate '
'software packages by exploiting abandoned GitHub repository '
'names. The flaw stemmed from npm’s reliance on human-readable '
'repository names rather than immutable numeric IDs to verify '
'trusted publishers, enabling attackers to claim a renamed or '
'deleted repository and inherit its publishing privileges. The '
'attack required no compromise of the original maintainer’s '
'GitHub or npm accounts. If exploited in the wild, a hijacked '
'package could execute attacker-controlled code during '
'installation, particularly through installation hooks or '
'AI-driven dependency selection.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to npm '
'and affected package maintainers',
'operational_impact': 'Potential execution of attacker-controlled '
'code during package installation',
'systems_affected': 'npm packages (1,500+ vulnerable packages)'},
'investigation_status': 'Resolved (no active exploitation observed)',
'lessons_learned': 'The flaw highlights the growing threat of supply-chain '
'attacks via automated dependency management, where '
'malicious packages no longer need to trick developers but '
'can exploit AI agents that automate package '
'installations.',
'post_incident_analysis': {'corrective_actions': 'npm implemented a 48-hour '
'expiry for unvalidated '
'Trusted Publishing '
'configurations and blocked '
'tokens issued via certain '
'GitHub Actions events.',
'root_causes': 'Reliance on human-readable '
'repository names instead of '
'immutable numeric IDs for Trusted '
'Publishing verification'},
'recommendations': 'Maintainers should audit their Trusted Publishing '
'bindings and verify that repository names still resolve '
'to controlled accounts. Organizations should monitor for '
'suspicious package updates and consider manual approval '
'for critical dependencies.',
'references': [{'source': 'Bloom Security'}],
'response': {'communication_strategy': 'Advisories to maintainers to audit '
'Trusted Publishing bindings and '
'verify repository names',
'containment_measures': '48-hour expiry for unvalidated Trusted '
'Publishing configurations, blocking '
'tokens issued via GitHub Actions’ '
'`issue_comment` and '
'`pull_request_target` events',
'remediation_measures': 'npm implemented fixes to address the '
'Trusted Publishing flaw',
'third_party_assistance': 'Bloom Security'},
'stakeholder_advisories': 'Maintainers advised to audit Trusted Publishing '
'bindings and verify repository names.',
'title': 'Critical npm Trusted Publishing Flaw Exposes Over 1,500 Packages to '
'Hijacking',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Trusted Publishing mechanism flaw (SlugFest)'}