Security researchers at Bloom Security discovered a weakness in npm's Trusted Publishing system that could have allowed attackers to hijack more than 1,500 legitimate software packages by reclaiming abandoned GitHub repository names, according to a report published Tuesday. The vulnerable packages, which included security scanners, authentication tools, and cryptographic software, collectively received over 10 million downloads and logged more than one million downloads each month. The flaw, which npm has since fixed, exposed millions of package installations to potential supply-chain attacks.
The vulnerability, which Bloom Security dubbed SlugFest, stemmed from npm's reliance on human-readable GitHub repository names rather than permanent numeric identifiers to verify trusted publishers. When a repository was renamed, transferred, or deleted, its former name could become available for another user to claim. An attacker who created a repository at that address and configured a GitHub Actions workflow with the expected filename could potentially obtain valid publishing credentials for a package they didn't own. The registry-wide scan identified one package that alone accounted for over 200,000 monthly downloads, according to the researchers. The attack required no compromise of the legitimate maintainer's GitHub or npm account and no theft of their credentials.
Bloom Security researcher Golan Myers confirmed to CSO that npm shipped a fix on October 2, introducing a 48-hour expiry for unvalidated Trusted Publishing configurations. Myers said Bloom has not observed active exploitation in the wild but confirmed the flaw was successfully used to publish a new version of an existing npm package under their own controlled testing conditions. The researchers demonstrated the attack against a researcher-controlled package, publishing a new version from a GitHub repository belonging to a different organization.
The report highlights that AI coding agents could accelerate the distribution of malicious dependencies because they increasingly select and install software packages with limited human intervention. Across dozens of organizations, the researchers measured approximately 70 agent-installed packages per endpoint each month, rising to around 350 on developer machines—figures that cover direct installations and exclude transitive dependencies. A malicious release could execute attacker-controlled code through an installation hook when developers or CI systems install the compromised package, and AI agents could introduce such a dependency without a developer explicitly selecting it. "A hijacked package doesn't need to find a developer anymore," Myers said. "It only needs to be the package an agent chooses."
Beyond the 48-hour expiry for unvalidated configurations, npm also tightened its safeguards by rejecting trusted-publishing tokens issued through GitHub Actions' issue_comment events, alongside the existing restriction on pull_request_target events. Bloom recommended that maintainers audit their Trusted Publishing configurations, verify that each trusted repository name still resolves to a repository under their control, and remove and recreate bindings where necessary. The researchers also advised security teams to audit software dependencies and tools used across their environments and enforce controls over what developers and AI agents are permitted to install. As autonomous coding assistants gain traction in enterprise development workflows, organizations may need to weigh the productivity gains against the expanding surface area for supply-chain compromise that human oversight once mitigated.