Critical npm Trusted Publishing Flaw (CVE-2024-XXXX) Exposes 1,500+ Packages

Key Takeaways

• A critical vulnerability, dubbed “SlugFest” (CVE-2024-XXXX), was discovered in npm’s Trusted Publishing feature.
• This flaw allowed attackers to potentially hijack over 1,500 npm packages, cumulatively downloaded more than 10 million times monthly.
• The vulnerability exploited how npm initially linked packages to GitHub repositories using human-readable names (slugs) instead of immutable IDs, enabling attackers to reclaim abandoned GitHub repository names.
• GitHub and npm have implemented a fix: new, unvalidated Trusted Publishing configurations now expire after 48 hours, and maintainers are advised to review and update their configurations.

Major Vulnerability in npm Trusted Publishing Exposes 1,500+ Packages

A significant security vulnerability within npm’s Trusted Publishing mechanism has come to light, potentially exposing over 1,500 packages to malicious takeover. This flaw, assigned CVE-2024-XXXX and dubbed “SlugFest,” presented a serious software supply-chain risk, as the affected packages collectively receive more than 10 million downloads and over one million monthly downloads. The vulnerability allowed attackers to exploit reclaimed GitHub repository names to gain unauthorized publishing access to these popular npm packages.

Unlike many previous npm compromises that relied on stolen tokens or compromised accounts, SlugFest offered a novel attack vector. An attacker did not need to acquire an npm token, breach a maintainer’s npm account, or gain access to the original GitHub repository. Instead, the vulnerability centered on the ability to claim an abandoned GitHub owner/repository name, which could then be leveraged to obtain a valid, short-lived npm publishing credential for any package still configured to trust that old repository location.

Analysts at Bloom Security identified this critical flaw, emphasizing that while it represented a package takeover path, there was no evidence of an active malicious campaign leveraging it. However, the potential for a successful takeover was substantial. Such an incident could enable the publication of malicious code, including harmful postinstall scripts, under the guise of a legitimate package. This malicious code would then be delivered to users during routine dependency installations. The recent ChainDrop npm worm serves as a stark reminder of how easily compromised releases can propagate through developer tools, repositories, and automated build environments, underscoring the severity of such vulnerabilities.

Understanding the Trusted Publishing Flaw

The npm Trusted Publishing feature was designed to enhance the security of npm releases. It allows maintainers to link a package to a GitHub repository and workflow using OpenID Connect (OIDC), eliminating the need to embed long-lived npm tokens directly into GitHub Actions or other CI/CD services. During a release, the workflow acquires a temporary identity token, which is then exchanged for an npm publishing credential. This process aims to mitigate risks associated with persistent secrets in build pipelines.

The core of the SlugFest vulnerability lay in npm’s initial method of linking a package to its publishing repository. For configurations that had not yet been validated, npm stored the human-readable GitHub repository path (known as a “slug,” e.g., organization/project) rather than immediately using GitHub’s permanent, immutable numeric repository and owner IDs. This distinction proved critical, as GitHub repository names can change ownership if a project is renamed, transferred, deleted, or if the owner’s account name is altered.

An attacker could exploit this by identifying an unvalidated Trusted Publishing configuration tied to a GitHub repository whose slug had become available. They could then create a new GitHub repository using that reclaimed slug, set up a workflow with the expected filename, request an OIDC token, and present it to npm. If the package’s Trusted Publishing configuration had never completed its first successful publish, npm could erroneously accept the new repository name as a match, issuing a valid publishing credential to the attacker. This would grant the attacker the ability to release new, potentially malicious versions under the legitimate npm package name.

This attack vector diverged significantly from typical token theft scenarios seen in previous npm compromises. While Trusted Publishing was specifically developed to reduce exposure from long-lived automation tokens, SlugFest demonstrated that even secure, short-lived credentials could be abused if the underlying identity binding relied on a mutable identifier like a repository slug instead of an immutable ID.

AI Coding Agents and Increased Exposure

Bloom Security’s research also highlighted the increasing role of AI coding agents in package installation, which exacerbates the risk posed by vulnerabilities like SlugFest. Their findings indicate that a typical endpoint installs approximately 70 packages per month via AI agents, with developer systems installing nearly 350 packages monthly. These figures only account for direct installations and do not include the numerous additional dependencies each package might pull in.

Tools such as coding assistants and integrated development environment (IDE) agents often select, install, and execute packages with minimal human oversight. If a legitimate dependency is covertly replaced with a malicious release, an AI agent might automatically select the newest version and execute its lifecycle scripts as part of standard setup procedures. This scenario underscores the heightened importance of rigorous package provenance, meticulous version pinning, and thorough review of install-time scripts.

This concern aligns with broader security risks associated with AI coding agents, where manipulated content can prompt an agent to execute attacker-controlled commands. In the context of SlugFest, the danger isn’t merely an AI prompt; it’s the possibility that an agent installs a package published through an ostensibly trusted release path, which has in fact been compromised.

Bloom reported the issue to GitHub via their HackerOne program on June 6, 2026. The vulnerability was validated on June 9, and GitHub implemented a fix on October 2, after over 120 days. GitHub’s updated policy now dictates that newly created but unvalidated Trusted Publishing configurations will expire after 48 hours. A configuration is only considered validated after its first successful publish, at which point it is permanently bound to the repository’s immutable identity. Further details can be found in the GitHub Changelog.

Additionally, GitHub has blocked Trusted Publishing tokens triggered by issue_comment events, supplementing existing restrictions on pull_request_target events. Maintainers utilizing affected workflows should transition their publishing processes to more secure events, such as push, release, or workflow_dispatch. The official npm Trusted Publishing documentation now explicitly states the two-day expiration policy for new, unvalidated configurations.

What You Should Do

• Review Trusted Publisher Configurations: Immediately audit all npm Trusted Publisher configurations to verify that each linked GitHub repository remains under your direct control.
• Recreate Bindings After Changes: If a GitHub repository has been renamed, deleted, or transferred, remove the existing Trusted Publishing binding and recreate it to ensure it’s linked to the immutable repository ID.
• Monitor for Suspicious Activity: Establish robust monitoring for any unexpected release activity or unauthorized package publications.
• Pin Dependency Versions: Where feasible, pin dependency versions in your projects to specific, known-good releases to prevent automatic updates to potentially compromised versions.
• Scrutinize Provenance Attestations: While provenance attestations indicate where a package was built, they do not guarantee the security of the source repository, account, or build environment. Always review them critically.
• Update Workflows: If your workflows rely on issue_comment or pull_request_target events for Trusted Publishing, migrate them to safer events like push, release, or workflow_dispatch.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.