npm Trusted Publishing slug flaw hit 1,500-plus packages

A now-fixed npm Trusted Publishing flaw let attackers reuse freed GitHub repository names to publish to more than 1,500 packages.

Bloom Security disclosed SlugFest, a flaw in npm Trusted Publishing that anchored trust to a human-readable GitHub repository name, or slug, instead of GitHub’s immutable repository ID until the first successful publish. An attacker who reclaimed a freed slug could exchange a GitHub Actions OIDC token for a short-lived credential and publish a package version without compromising the maintainer; CSO Online described the name as abandoned, while The Hacker News said it could have been renamed, transferred, or deleted. Both outlets reported more than 1,500 packages with over 10 million combined downloads, though CSO called them potentially exposed and The Hacker News described them as exposed or vulnerable to hijacking. Bloom told GitHub on June 6, 2026. CSO said npm shipped a fix on October 2 that expires unvalidated configurations after 48 hours, while The Hacker News credits GitHub with that expiry; both say tokens from issue_comment events are rejected. CSO also said Bloom found no in-the-wild exploitation but published a test package version, and neither outlet named a CVE.

• Bloom Security disclosed SlugFest: npm Trusted Publishing trusted a GitHub repository slug (human-readable name) rather than GitHub’s immutable repository ID until the first successful publish.
• Bloom notified GitHub on June 6, 2026.
• Both outlets reported more than 1,500 packages and over 10 million combined downloads; CSO called them potentially exposed, while The Hacker News called them exposed or vulnerable to hijacking.
• Reclaiming a freed slug—an abandoned name, or one that was renamed, transferred, or deleted—could yield a short-lived GitHub Actions OIDC credential to publish a version the attacker did not own.
• CSO said npm shipped a fix on October 2 that expires unvalidated Trusted Publishing configs after 48 hours; The Hacker News attributes the same 48-hour expiry to GitHub.
• Both reports say trusted-publishing tokens from issue_comment workflows are rejected.
• CSO said Bloom found no in-the-wild exploitation but published a test package version.
• Neither report named a CVE or specific package versions.