GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

October 13, 2026 · 9:00 am 2 sources

Image: Help Net Security

Coverage

Coverage

• npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
  Help Net Security · October 13, 2026 09:00
  Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages…

More coverage

• GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
  The Hacker News · October 13, 2026 16:18
  GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes…