Bloom Security researchers expose npm Trusted Publishing flaw affecting 1,500+ packages

Bloom Security researchers reported the SlugFest flaw to GitHub on June 6, 2026, and found that more than 1,500 npm packages were vulnerable. Bloom Security researchers explained that an attacker can inherit a package’s publishing trust by claiming a GitHub repository name that its original owner had abandoned, without needing to steal credentials, and that the SlugFest attack requires no insider knowledge, credential theft, or race conditions, relying solely on the availability of abandoned repository slugs.

Bloom Security researchers explained that the flaw, named SlugFest, relies on GitHub repository slugs instead of immutable repository IDs to establish trust, and that a slug can become available after a repository undergoes renaming, transfer, or deletion, allowing an attacker to claim the name and satisfy the existing Trusted Publisher binding without needing the legitimate maintainer’s credentials. They also demonstrated the SlugFest attack by publishing a new version of a researcher-controlled npm package from a GitHub repository belonging to a different organization, using only the reclaimed repository slug.

Bloom Security reported the SlugFest flaw to GitHub on June 6, 2026; GitHub triaged it on June 9, 2026, and the last response before the fix arrived on July 8, 2026. GitHub confirmed that a fix for the SlugFest vulnerability was shipped on October 2, 2026, introducing a 48‐hour expiry for unvalidated Trusted Publishing configurations.

GitHub, which owns npm, shipped a fix that expires unvalidated Trusted Publishing configurations after 48 hours to mitigate the SlugFest vulnerability. GitHub and npm tightened security by rejecting trusted-publishing tokens issued through GitHub Actions’ issue_comment events, alongside existing restrictions on pull_request_target events, to mitigate the SlugFest vulnerability. Bloom Security noted that the fix addresses unvalidated configurations, but maintainers still need to review their existing trust relationships and recreate bindings after repository renames or transfers.

Bloom Security researchers measured that the more than 1,500 vulnerable npm packages had over 10 million combined downloads and exceed one million downloads per month. Bloom Security researchers found that a single vulnerable npm package accounted for over 200,000 monthly downloads.

Bloom Security researchers measured that AI agents install approximately 70 packages per endpoint each month, rising to around 350 on developer machines, increasing supply‐chain exposure. Bloom Security researchers warned that a malicious npm package could run attacker‐controlled code via installation hooks when installed, and AI agents could add it without developer selection. Bloom Security reported observing a customer’s AI agent attempting to install one of the vulnerable npm packages affected by the SlugFest flaw, illustrating the real‐world risk of automated dependency installation. Bloom Security researchers found that AI coding agents install between 0.3 and 1.2 packages per day on average, with developer machines experiencing up to two to three direct package installations daily.

Bloom Security recommended that package maintainers audit their Trusted Publishing configurations using `npm trust list` and verify that each repository slug still resolves to a repository under their control. Bloom Security advised security teams to audit software dependencies and enforce controls over what developers and AI agents are permitted to install to mitigate supply‐chain risks.

npm’s Trusted Publishing feature, launched in Jul. 2025, lets maintainers publish packages via CI/CD pipelines using short-lived OpenID Connect tokens instead of long-lived secrets, automatically generating provenance attestations for supply-chain security. Bloom Security highlighted that a malicious release could carry an attestation associated with the attacker’s own repository, potentially bypassing provenance verification systems that only check for attestation existence rather than source authenticity. Bloom Security found that the SlugFest vulnerability also affected npm’s GitLab Trusted Publishing implementation, indicating a broader issue with the platform’s trust verification mechanisms.