npm Trusted Publishing flaw put 1,500 packages at risk of takeover

Feeds.4Sysops •IT News • October 13, 2026

GitHub has changed npm Trusted Publishing so unused configurations expire after 48 hours, addressing a flaw that put more than 1,500 packages at risk of takeover. Attackers could claim an abandoned GitHub repository name and publish under a package’s legitimate npm name—without stealing credentials. The exposed packages have more than 10 million downloads combined. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

npm Trusted Publishing Flaw Exposes 1,500+ Packages to Hijacking A vulnerability in npm's Trusted Publishing feature allowed attackers to hijack over 1,500 packages by claiming abandoned GitHub repository names. Researchers at Bloom Security discovered that attackers could push new versions of packages without needing to steal credentials, simply by registering a previously used repository name. The flaw, dubbed 'SlugFest', was reported to GitHub on June 6, 2026, and a fix was implemented on October 2, 2026, which now requires unvalidated configurations to expire after 48 hours. The affected packages had over 10 million downloads in total, with some packages being downloaded over a million times monthly. GitHub has since updated its documentation to reflect these changes and emphasized the importance of maintaining trust relationships for package publishing. No active exploitation has been observed in the wild, but researchers successfully demonstrated the attack in controlled conditions. 4 sources 42

Extracted Entities

npm Trusted Publishing flaw put 1,500 packages at risk of takeover

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)