Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A flaw in npm’s Trusted Publishing mechanism could allow attackers to hijack legitimate software packages by reclaiming abandoned GitHub repository names, potentially exposing millions of package downloads to supply-chain attacks . Researchers at Bloom Security identified more…
Riportata anche da Help Net Security
The issue is now fixed, Bloom Security researcher Golan Myers told CSO. “The npm team confirmed that a fix had been shipped on October 2, introducing a 48-hour expiry for unvalidated Trusted Publishing configurations,” he said.
Myers said Bloom has not observed active exploitation in the wild, but confirmed that the flaw was successfully used to publish a new version of an existing npm package under their own controlled testing conditions. The fix addresses the exposure associated with unvalidated configurations, although maintainers still need to review their existing trust relationships, Bloom wrote in a blog post shared with CSO ahead of its publication on Tuesday.
npm’s Trusted Publishing allows package maintainers to publish releases through automated workflows using OpenID Connect (OIDC), avoiding long-lived publishing credentials. However, Bloom found that npm’s trust configuration relied on the GitHub repository’s owner/repository name instead of its immutable repository ID.
