npm Trusted Publishing slug-reuse flaw exposed over 1,500 packages to unauthorized takeover

Bloom Security disclosed a flaw in npm's Trusted Publishing, which binds a package to a GitHub repository and workflow. npm recorded the binding by repository slug rather than GitHub's permanent numeric IDs, so once a bound repository or owner was renamed, transferred, or deleted, an attacker could claim the freed slug, add a matching workflow, and receive a publish credential, even forging a valid provenance attestation. Bloom counted more than 1,500 exposed packages with over 10 million total downloads. GitHub, notified in June through HackerOne, shipped a fix in October so unvalidated configurations expire after 48 hours. It is unknown whether anyone exploited the weakness in the wild.

Check

Run npm trust list to confirm each bound repository still belongs to you, rebind any pointing to renamed or transferred repositories, and remove bindings before deleting a repository.

Affected

npm packages bound through Trusted Publishing to a repository or owner that was later renamed, transferred, or deleted could be hijacked by an attacker claiming the freed slug.

Fix

Verify and rebind Trusted Publishing configurations, check that package provenance attestations name the expected repository, and apply the same review to GitLab-based Trusted Publishing.