SlugFest: npm Trusted Publishing Bound Packages to Reclaimable GitHub Repo Names, Exposing 1,500+ Packages to Takeover

Bloom Security (Golan Myers) disclosed SlugFest on 13 October 2026. npm Trusted Publishing bound a package to a GitHub owner/repo slug and stored the immutable numeric repository and owner IDs only after the first successful publish, so when a bound repository or owner was renamed, transferred or deleted, an attacker could claim the old slug, add a workflow with the expected filename and exchange its OIDC token for a publish credential without stealing anything. Bloom counted more than 1,500 vulnerable packages with over 10 million total downloads (more than 1 million a month), did not publish the list, and says npm's GitLab trusted publishing was also affected. It reproduced the takeover end to end against its own scope and repositories. Bloom reported via GitHub's HackerOne program on 6 June 2026 (validated 9 June) and found it fixed on retest roughly 120 days later, referencing a GitHub changelog entry of 2 October; the fix invalidates any trust binding that sees no publish within 48 hours of creation, rather than resolving IDs at creation as PyPI does. No malicious takeover in the wild is reported. Bloom says it blocked a customer's AI coding agent trying to install one of the affected packages a few weeks before publication, the reason it frames this as an agent risk: an agent picks and installs dependencies with little human review.

You are affected if you run npm Trusted Publishing configurations (GitHub and GitLab) created before the October 2026 fix whose bound repository or owner was later renamed, transferred or deleted..

Maintainers: run `npm trust list` for every package and confirm each bound slug still points to a repository you control; delete and recreate a binding after renaming or transferring a repository, remove it before deleting one, publish right after creating a new binding so npm pins the numeric IDs, and alert on publish events you did not initiate. Security teams: route AI-agent package installs through a supply-chain firewall or allowlist, and inventory the packages, extensions, MCP servers and skills that agents install on developer machines.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run npm Trusted Publishing configurations and which version, then enforce a policy on it.