How npm Trusted Publishing Slug Reuse Enabled Package Takeovers
Researchers showed that attackers could hijack npm packages by claiming abandoned GitHub repository names, exposing over 1,500 packages to unauthorized updates.
Key points
- Bloom Security identified a flaw in npm’s Trusted Publishing feature allowing package takeover via repository name reuse.
- The issue affected more than 1,500 packages with over 10 million total downloads, according to Help Net Security.
- GitHub stated it has shipped fixes after validating the report in June.
npm’s Trusted Publishing feature contained a configuration flaw that allowed attackers to publish malicious versions of packages without stealing credentials. Bloom Security researchers demonstrated that an adversary could exploit abandoned GitHub repository names to gain publishing rights, effectively hijacking the supply chain for affected software packages.
Root cause
The vulnerability stemmed from how npm handled repository identifiers. The system recorded repositories using GitHub slugs, which are owner/repo name strings. GitHub also assigns permanent numeric IDs that survive renames and transfers, including these IDs in identity tokens. However, npm failed to verify these numeric IDs when exchanging tokens for publishing credentials, relying solely on the mutable slug names.
Attack path
When a maintainer renamed, transferred, or deleted a bound repository, the original slug became available for registration. An attacker could create a new repository with that same name and add a workflow file with the matching filename. This allowed the attacker to receive a valid publishing credential for a package they did not own. Bloom researchers executed this attack end-to-end on controlled packages, proving the method works.
Affected versions
The flaw impacted the Trusted Publishing feature, which became generally available in July 2025. According to Help Net Security, Bloom Security counted more than 1,500 npm packages exposed to this takeover vector. These packages collectively recorded more than 10 million downloads in total and over one million downloads per month, averaging several hundred monthly downloads per package.
Mitigation
GitHub stated it has shipped fixes for the issue. The company also retires repository names with more than 100 clones in the week before an owner account is renamed or deleted, which protected some packages from this specific attack vector. Bloom Security reported the issue through GitHub’s bug bounty program on HackerOne on June 6, and GitHub validated it on June 9.
What to do and how to stay safe: npm
- Monitor official channels for vendor updates regarding Trusted Publishing configurations.
- Verify package integrity by checking provenance attestations and build records.
- Audit repository permissions and ensure no abandoned slugs are linked to critical packages.
- Once the vendor provides an update, apply it immediately to prevent unauthorized publishing.
Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did attackers steal credentials to exploit this flaw?
No, the attack did not involve stealing credentials. Attackers only needed to register a GitHub repository name that the original maintainer had left behind or deleted.
How many packages were exposed to this risk?
Bloom Security counted more than 1,500 npm packages exposed to this takeover method, according to Help Net Security.
Has the vendor addressed the issue?
Yes, GitHub stated it has shipped fixes for the Trusted Publishing flaw after validating the report in June.
