SlugFest: The npm Trusted Publishing flaw that trusted names, not IDs

SlugFest, disclosed by Bloom Security in October 2026, describes a flaw in npm Trusted Publishing where trust configurations initially relied on mutable GitHub owner/repository names rather than immutable repository and owner IDs, allowing an attacker to claim an abandoned slug, recreate the expected workflow, obtain an OIDC token, and publish a package without compromising the original maintainer’s credentials. Bloom identified more than 1,500 potentially exposed packages with over 10 million total downloads, although exploitation in the wild is unknown, and noted that attacker-produced releases can still carry valid Sigstore provenance unless consumers verify the expected source repository. The OpenSSF standard had already warned about rename and resurrection attacks and recommends resolving and storing immutable IDs when a trust relationship is configured, an approach Bloom says PyPI already uses. GitHub and npm introduced a mitigation that expires unvalidated npm publishing configurations after 48 hours and restricts certain workflow events, but the report argues this reduces rather than eliminates the risk because configurations are still initially created from names. The incident highlights a broader authorization principle: systems should use immutable, system-assigned identifiers for access decisions while retaining mutable names, slugs, email addresses, and domains only for display or lookup.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.