npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes.

The exposed packages have more than 10 million downloads in total and more than a million a month. That averages out to several hundred monthly downloads per package, but one hijacked package is enough. A malicious version can…