Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A flaw in npm’s Trusted Publishing mechanism could allow attackers to hijack legitimate software packages by reclaiming abandoned GitHub repository names, potentially exposing millions of package downloads to supply-chain attacks . Researchers at Bloom Security identified more…
Podają ją też The Hacker News, Help Net Security
The issue is now fixed, Bloom Security researcher Golan Myers told CSO. “The npm team confirmed that a fix had been shipped on October 2, introducing a 48-hour expiry for unvalidated Trusted Publishing configurations,” he said.
Myers said Bloom has not observed active exploitation in the wild, but confirmed that the flaw was successfully used to publish a new version of an existing npm package under their own controlled testing conditions. The fix addresses the exposure associated with unvalidated configurations, although maintainers still need to review their existing trust relationships…
