Science & Tech · Cybersecurity · 4 hrs ago
Flaw exposed more than 1,500 npm packages to takeover
A flaw put more than 1,500 npm packages at risk of being taken over, according to security researchers at Bloom Security.
The packages use npm, a service for sharing software code, and GitHub’s Trusted Publishing feature to publish updates without long-lived access tokens.
Attackers could claim an abandoned GitHub repository name and use it to get permission to publish a package they did not own.
A harmful update could include code that runs automatically when people install it.
GitHub says it changed the system so unvalidated publishing setups expire after 48 hours and cannot authorize publishing.
It is unclear whether the change also protected setups that had already published successfully, and researchers do not know whether attackers used the flaw.
The exposed packages had more than 10 million downloads combined, making the flaw a potential risk for people and software that depend on them.
Bloom Security researchers found that npm’s Trusted Publishing feature could let an attacker publish new versions of packages without stealing credentials.
The attack depended on a maintainer leaving behind a GitHub repository name bound to a package.
Bloom counted more than 1,500 exposed npm packages, with more than 10 million downloads in total.
GitHub says it has shipped fixes, including making unvalidated Trusted Publishing configurations expire after 48 hours.
Bloom researcher Golan Myers said it is unknown whether anyone exploited the flaw in the wild.
- Who
- Bloom Security researchers found the flaw; GitHub, which owns npm, says it shipped fixes.
- What
- A flaw in npm Trusted Publishing could let an attacker publish a package using a repository name its maintainer had left behind.
- When
- GitHub announced a change on October 2. The feature has been generally available since July 2025.
- Where
- npm packages linked to GitHub repositories.
- Why
- npm checked repository names but not the permanent numeric IDs in GitHub’s identity tokens. A name left behind could be claimed by someone else.
This story does not have two clearly opposing sides.
Bloom reported the issue through GitHub’s bug bounty program on HackerOne.
GitHub validated Bloom’s report.
Bloom says it received its last reply from GitHub.
GitHub announced a change to Trusted Publishing configurations.
- Exposed packages
- More than 1,500 npm packages
- Total downloads
- More than 10 million
- Configuration expiry
- 48 hours after creation, if unvalidated
- Feature availability
- Generally available since July 2025
- Bug report date
- June 6
What people are saying
We took this into account. Everything we considered vulnerable was pertaining to claimable slugs.
We learned of this event through our bug bounty program and worked to validate the report and ship fixes to remediate the issue. Unvalidated Trusted Publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This limits the risk of trusting a repository or project name that changes ownership.
Sources
Related news
Ahold Delhaize takes some systems offline after cyberattack
Cyberattack overheats refrigeration systems in hundreds of French supermarkets
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
GitLab urges self-managed users to patch critical code execution flaw
Ridge Security launches on-site AI penetration testing system
French supermarket hack raises concerns about smart home devices
Hackers take control of cooling units at 350 French supermarkets
Canadian cybersecurity executive arrested on federal extortion charges
