GitHub Tightens npm Trusted Publishing After SlugFest Flaw Exposed 1,500 Packages

GitHub Acts on npm Trusted Publishing Flaw

GitHub has introduced a 48-hour expiry for unvalidated npm trusted publishing configurations after researchers at Bloom Security uncovered a vulnerability that left more than 1,500 packages open to hijacking. The change requires a new trusted publisher configuration to complete its first successful publish within two days, after which the configuration becomes validated and bound to the repository's immutable identifier.

How the SlugFest Attack Worked

Trusted publishing, launched in July 2025, lets developers push packages from CI/CD platforms using short-lived OIDC tokens instead of long-lived secrets. However, npm initially verified only the repository slug, the owner and repository name, and ignored the permanent numeric ID that GitHub assigns. When a maintainer renamed, transferred, or deleted a repository, the slug became available for anyone to claim. An attacker could create a repository at the freed slug, trigger a publish workflow, and obtain a valid publish token for a package they did not own. The attack, dubbed SlugFest, could publish a malicious version under the legitimate package name, inheriting its reputation and download counts.

Impact and Mitigation Steps

Bloom Security reported the issue to GitHub on June 6, 2026, and identified over 1,500 vulnerable packages with a combined download count exceeding 10 million. The firm warned that AI agents that automatically resolve dependencies could amplify the risk by pulling the latest malicious version without human review. GitHub now rejects trusted publishing tokens from GitHub Actions issue_comment events and maintains the existing pull_request_target restriction. Developers are advised to audit their trusted publisher bindings, verify that the listed slug still resolves to a repository they control, and delete and recreate bindings whenever a repository is renamed, transferred, or deleted.

Broader Supply Chain Lessons

The SlugFest finding follows an earlier discovery by Bloom Security in August involving extension packs in Open VSX and the VS Code Marketplace. That technique, called Extension Resurrection, allowed attackers to claim unclaimed namespaces referenced inside trusted bundles, leading to potential remote code execution. Both cases highlight how trust systems that rely on mutable human-readable identifiers can be subverted when those identifiers change hands.

Sources: The Hacker News