--- title: SlugFest: npm Trusted Publishing flaw exposed more than... description: Security researchers at Bloom Security disclosed a flaw dubbed SlugFest in npm's Trusted Publishing system, which affected over 1,500 packages with more than... canonical: https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SlugFest: npm Trusted Publishing flaw exposed more than 1,500 packages | daily.dev og:description: Security researchers at Bloom Security disclosed a flaw dubbed SlugFest in npm's Trusted Publishing system, which affected over 1,500 packages with more than... og:url: https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj og:image: https://api.daily.dev/og/posts/2uoPWbJaj.png og:image:alt: SlugFest: npm Trusted Publishing flaw exposed more than 1,500 packages og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SlugFest: npm Trusted Publishing flaw exposed more than 1,500 packages **[Collections](https://daily.dev/sources/collections)** · 2 min read · 3 upvotes · 1 comments ## Summary Security researchers at Bloom Security disclosed a flaw dubbed SlugFest in npm's Trusted Publishing system, which affected over 1,500 packages with more than 10 million combined downloads, including security scanners, auth tools, and crypto libraries. The vulnerability stemmed from npm identifying GitHub repositories by their human-readable slug rather than a permanent repository ID, letting an attacker claim a renamed, transferred, or deleted repo's old slug, recreate the matching workflow filename, and obtain a valid publishing credential without ever compromising the maintainer's account. npm's GitLab Trusted Publishing was also affected. No in-the-wild exploitation was observed, though the researchers reproduced it under controlled conditions. The flaw reportedly stayed exploitable for more than 120 days between HackerOne report validation on June 9 and npm's fix on October 2, which now expires unvalidated configurations after 48 hours and stores immutable repository identifiers, matching what PyPI's Warehouse already does. GitHub separately restricted trusted-publishing tokens issued via issue_comment events. The researchers also flag that AI coding agents, which install an average of 70 packages per endpoint monthly (up to 350 on developer machines), amplify the risk since a hijacked package just needs to be picked up automatically rather than approved by a human. ## Content Bloom Security disclosed a flaw it calls SlugFest in npm's Trusted Publishing system. It left more than 1,500 packages, with over 10 million combined downloads, open to takeover. No credentials had to be stolen. ## What went wrong Trusted Publishing is supposed to let a package be published only from a specific GitHub repository and workflow. But npm tied that trust to the repository's human-readable name (its slug), not its permanent ID. So if a repository was renamed, transferred, or deleted, an attacker could register the old slug, match the workflow filename, and get a valid publishing credential for the existing npm package. The maintainer's account never had to be compromised. npm's GitLab Trusted Publishing was affected too. The exposed packages include security scanners, authentication tools, and cryptographic libraries. More than a million monthly downloads were involved. Nobody has reported exploitation in the wild, but the attack was demonstrated under controlled conditions. ## Why AI coding agents make it worse Bloom's more uncomfortable finding is about who installs packages now. AI coding agents install about 70 packages per month per endpoint, and up to 350 on developer machines. Often nobody reviews postinstall scripts or provenance. A hijacked package doesn't need to fool a careful human anymore. It only needs to get picked by an agent, and a malicious postinstall hook can run automatically. That's the part I'd worry about. The flaw itself was fixable, but the habit of installing without looking is spreading. ## Timeline and fix - June 6, 2026: Bloom reported the issue through HackerOne. - June 9: it was validated. - The flaw stayed exploitable for more than 120 days while npm worked on a fix. - October 2: npm shipped a change that gives unvalidated Trusted Publishing configurations a 48-hour expiry. npm now stores immutable repository identifiers, which is how PyPI's Warehouse already worked. - GitHub also tightened restrictions on trusted-publishing tokens issued via issue_comment events. ## What Bloom recommends - Audit all automated software installation. - Put a supply-chain firewall in front of installs. - Verify immutable repository identifiers instead of slugs. Four months is a long time for a hole like this to stay open, even with no sign anyone used it. ## Questions this post answers ### What was the SlugFest vulnerability in npm Trusted Publishing? SlugFest was a flaw where npm identified GitHub repositories by their human-readable slug instead of a permanent repository ID. If a repo was renamed, transferred, or deleted, its old slug became reclaimable; an attacker could claim it, recreate the matching workflow filename, and obtain a valid publishing credential for the original npm package without compromising the maintainer's account. It affected over 1,500 packages with 10+ million downloads. _Teams relying on trusted publishing for CI/CD can follow supply chain vulnerability writeups like this on daily.dev._ ### How did npm fix the SlugFest trusted publishing vulnerability? npm shipped a fix on October 2 that makes unvalidated Trusted Publishing configurations expire after 48 hours and stores immutable repository identifiers instead of relying on slugs, matching what PyPI's Warehouse already does. GitHub separately tightened restrictions on trusted-publishing tokens issued via issue_comment events. The bug reportedly stayed exploitable for more than 120 days after being reported. _Developers patching CI/CD publishing pipelines can track fixes like this through daily.dev._ ### Why do AI coding agents increase the risk of npm supply chain attacks like SlugFest? AI coding agents install an average of 70 packages per endpoint each month, and up to 350 on developer machines, removing the human review step that would normally catch a suspicious package before installation. A hijacked package only needs to be selected by an agent rather than approved by a person, and a malicious postinstall hook can then run automatically with no oversight. _Developers weighing AI agent autonomy against supply chain risk can find analysis like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@petecapecod** · 0 upvotes > Socket dev firewall for the win again!! ## Similar posts on daily.dev - [Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm](https://daily.dev/posts/red-hat-npm-packages-compromised-in-supply-chain-attack-spreading-credential-stealing-worm-q3mbz24yd) · Orca Security Blog · 0 upvotes · 0 comments - [New npm supply-chain attack self-spreads to steal auth tokens](https://daily.dev/posts/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens-p3mykawe4) · BleepingComputer · 122 upvotes · 17 comments - [Four More Supply Chain Attacks Hit npm and PyPI](https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp) · GitGuardian · 7 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#github](https://daily.dev/tags/github), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SlugFest: npm Trusted Publishing flaw exposed more than 1,500 packages","url":"https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj"},"datePublished":"2026-10-13T10:15:56.205Z","dateModified":"2026-10-13T10:33:41.701Z","description":"Security researchers at Bloom Security disclosed a flaw dubbed SlugFest in npm's Trusted Publishing system, which affected over 1,500 packages with more than...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4b5e3c05aeb74e1f7a1a3643c21f4df?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c4b5e3c05aeb74e1f7a1a3643c21f4df?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"cyber,ai-agents,github,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"SlugFest: npm Trusted Publishing flaw exposed more than 1,500 packages"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj","comment":[{"@type":"Comment","text":"Socket dev firewall for the win again!!","datePublished":"2026-10-13T14:19:26.347Z","url":"https://daily.dev/posts/2uoPWbJaj#c-yQrWuKcEB","author":{"@type":"Person","name":"Peter Cruckshank","url":"https://daily.dev/petecapecod","image":"https://media.daily.dev/image/upload/s--ZJhQyKws--/f_auto/v1721235024/avatars/avatar_A9xh33q0QoxtkGoJRCosp"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/slugfest-npm-trusted-publishing-flaw-exposed-more-than-1-500-packages-2uopwbjaj#faq","mainEntity":[{"@type":"Question","name":"What was the SlugFest vulnerability in npm Trusted Publishing?","acceptedAnswer":{"@type":"Answer","text":"SlugFest was a flaw where npm identified GitHub repositories by their human-readable slug instead of a permanent repository ID. If a repo was renamed, transferred, or deleted, its old slug became reclaimable; an attacker could claim it, recreate the matching workflow filename, and obtain a valid publishing credential for the original npm package without compromising the maintainer's account. It affected over 1,500 packages with 10+ million downloads. Teams relying on trusted publishing for CI/CD can follow supply chain vulnerability writeups like this on daily.dev."}},{"@type":"Question","name":"How did npm fix the SlugFest trusted publishing vulnerability?","acceptedAnswer":{"@type":"Answer","text":"npm shipped a fix on October 2 that makes unvalidated Trusted Publishing configurations expire after 48 hours and stores immutable repository identifiers instead of relying on slugs, matching what PyPI's Warehouse already does. GitHub separately tightened restrictions on trusted-publishing tokens issued via issue_comment events. The bug reportedly stayed exploitable for more than 120 days after being reported. Developers patching CI/CD publishing pipelines can track fixes like this through daily.dev."}},{"@type":"Question","name":"Why do AI coding agents increase the risk of npm supply chain attacks like SlugFest?","acceptedAnswer":{"@type":"Answer","text":"AI coding agents install an average of 70 packages per endpoint each month, and up to 350 on developer machines, removing the human review step that would normally catch a suspicious package before installation. A hijacked package only needs to be selected by an agent rather than approved by a person, and a malicious postinstall hook can then run automatically with no oversight. Developers weighing AI agent autonomy against supply chain risk can find analysis like this on daily.dev."}}]} ```