Bloom Security found that npm Trusted Publishing could be tricked into accepting a reclaimed GitHub repository name, exposing more than 1,500 npm packages to takeover. GitHub says it has shipped fixes, and Bloom demonstrated the issue end to end against a real package without stealing any credentials.
The break was in the trust check: npm looked at the GitHub repository’s human-readable slug, not its permanent numeric ID. If a maintainer renamed, transferred, or deleted the old repo, an attacker who claimed that freed name and matched the workflow file could publish a new package version and even get a valid provenance attestation.
For maintainers who tied publishing rights to GitHub names that can change hands, the exposure is in the trust relationship itself, not just in a lost token. Packages with abandoned or recycled repository names are the ones that can still inherit that bad binding after the vendor fix.
Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A weakness in npm's trust model could let attackers publish updates to legitimate packages by claiming abandoned GitHub repository names, researchers found.