Bloom Security (Organization): news timeline & CVEs

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub expires unused npm trusted-publisher configs after 48 hours following a slug-reuse flaw affecting 1,500-plus packages.

Bloom Security told GitHub on June 6, 2026, that npm trusted publishing anchored trust to a repository slug rather than GitHub's immutable repository ID until the first successful publish. An attacker who reclaimed a freed slug could exchange a GitHub Actions OIDC token for a short-lived credential and publish a malicious version of a package they did not own, an issue dubbed SlugFest. Researchers found more than 1,500 exposed packages with over 10 million collective downloads. GitHub now expires unvalidated trusted-publisher configurations after 48 hours and rejects tokens from issue_comment events.

The Hacker NewsOct 13, 16:18 UTC · 3d agoVulnerability 2 sources3· 2 reads

Over 1,500 npm packages exposed by Trusted Publishing validation flaw

A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.

Bloom Security disclosed SlugFest, a flaw in npm Trusted Publishing that verified publishers by human-readable GitHub repository names instead of permanent repository IDs. An attacker who reclaimed an abandoned name could obtain an OIDC publishing credential and release a package version without compromising the maintainer. Researchers found more than 1,500 potentially exposed packages with over 10 million combined downloads. npm shipped a fix on October 2 that expires unvalidated configurations after 48 hours; Bloom reported no in-the-wild exploitation.

CSO Onlineupdated Oct 13, 16:18 UTC · 3d agofirst Oct 13, 10:02 UTC · 3d agoVulnerability 2 sources1

Bloom Security

Timeline2 articles

Appears with

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

Over 1,500 npm packages exposed by Trusted Publishing validation flaw