What Happened
Bloom Security found a flaw it calls SlugFest in npm trusted publishing. Trusted publishing lets GitHub Actions publish packages with short-lived tokens instead of stored secrets. npm identified the source repository by its name, owner/repository, and ignored GitHub’s permanent numeric ID until the first successful publish. The Hacker News reports Bloom found more than 1,500 vulnerable packages with more than 10 million downloads.
The attack needs no stolen credentials. A trusted publisher points to a repository name now free after a rename, transfer, or deletion, and the repository has never published. The attacker recreates the name, runs a publish workflow, and receives a valid npm credential. The malicious version then ships under the trusted package name.
GitHub now expires unvalidated trusted publisher setups after 48 hours. A first successful publish validates the setup. npm also rejects tokens from GitHub Actions issue_comment events.
Why This Matters for Canadian Organizations
Canadian companies, universities, and public agencies ship and consume npm packages every day. A hijacked package reaches build servers, developer laptops, and production systems before anyone reviews it. Bloom warns AI coding agents resolve dependencies automatically and rarely check provenance, so malicious versions run without human review.
Supply chain compromise carries compliance weight. Federally regulated firms answer to OSFI Guideline B-13 on third-party risk, and a package leaking personal information triggers PIPEDA breach reporting. The report names no exploited package yet. GitHub’s change closes the new-binding path, but older bindings need your attention.
What to Do
Audit every npm trusted publisher binding you own. Confirm each listed repository name still points to a repository you control. Delete and recreate bindings after any rename or transfer, and remove bindings when you delete a repository. Monitor npm for unexpected publish events on your packages. On the consumer side, pin dependency versions, require lockfiles, and review new releases before agents or pipelines pull them. Check our TechTalk archive and News coverage for more supply chain reports.
