npm fixes publishing flaw that let reclaimed repository addresses bypass trust

npm has fixed a Trusted Publishing vulnerability that could let an attacker publish under a legitimate package name by reclaiming a GitHub repository address, Bloom Security reported. Its scan identified more than 1,500 vulnerable packages with over 10 million combined downloads. The flaw arose when trust configurations referenced a repository's readable address without immediately recording its permanent identifier. Bloom demonstrated publication from a second, researcher-controlled repository after reclaiming the address. Automated package installations could then distribute malicious releases and execute installation scripts. Bloom discovered the fix while repeating its attack test before publication; npm subsequently confirmed remediation. The scan covered packages configured for Trusted Publishing, a subset of npm's ecosystem.