Skip to content
npm Trusted Publishing Flaw Exposes 1,500+ Packages to Takeover

npm Trusted Publishing Flaw Exposes 1,500+ Packages to Takeover

First seen 13 Oct 2026, 10:56 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 12:30 UTC
  • •Over 1,500 npm packages were vulnerable to hijacking due to a flaw in Trusted Publishing.
  • •Attackers could publish malicious versions without stealing credentials by exploiting freed repository names.
  • •GitHub implemented a fix that limits the validity of unvalidated configurations to 48 hours.

A flaw in npm's Trusted Publishing feature allowed attackers to hijack over 1,500 npm packages by exploiting freed GitHub repository names. The vulnerability, identified by Bloom Security, enables an attacker to publish malicious package versions without needing credentials, affecting packages with over 10 million total downloads. GitHub has since implemented a fix that ensures unvalidated configurations expire after 48 hours. The issue was reported to GitHub on June 6, 2026, and validated shortly after, but Bloom's follow-ups went unanswered until a fix was announced on October 2, 2026. The flaw highlights the risks associated with repository name changes and the importance of maintaining secure publishing configurations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-06
Vulnerability reported to GitHub
Bloom Security reported the npm Trusted Publishing flaw through GitHub's bug bounty program.
Helpnetsecurity
2026-06-09
Vulnerability validated by GitHub
GitHub confirmed the vulnerability reported by Bloom Security.
Helpnetsecurity
2026-10-02
Fix announced for Trusted Publishing
GitHub announced that unvalidated configurations would now expire after 48 hours to mitigate the risk.
github.blog

More articles in this cluster (2)

Following this threat?

Track Bloom Security in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

How many packages were affected?
Over 1,500 npm packages were identified as vulnerable to takeover.
What is the current status of the vulnerability?
The vulnerability has been patched, and GitHub has implemented measures to prevent future occurrences.
What should npm package maintainers do?
Maintain secure repository configurations and monitor for any changes in ownership or repository names.