Overview
- Bloom Security reported the flaw to GitHub in June and showed that npm trusted-publishing bound trust to a human-readable slug instead of a repository's immutable numeric ID, letting claimable names inherit publish rights.
- Researchers demonstrated the attack end to end and identified more than 1,500 exposed npm packages with over 10 million total downloads that could receive malicious updates.
- GitHub and npm changed behavior in October so unvalidated trusted-publisher settings expire after 48 hours unless a first successful publish occurs, and a first publish now binds the trust to the repository's immutable identity.
- The platform also blocks some token sources for trusted publishing and updated documentation, and maintainers are urged to run npm trust list, delete and re-create bindings after renames or transfers, and remove bindings before deleting repos.
- There is no confirmed evidence of real-world exploitation so far, but researchers warn AI coding agents and automated installs raise the risk that a reclaimed malicious release could spread widely and run automatically on user machines.