npm Trusted Publishing flaw let attackers hijack 1,500 packages

The flaw

In October 2026, researchers disclosed a vulnerability they called Slugfest ^[1]. It exploited npm's Trusted Publishing feature, which lets package maintainers publish new versions directly from GitHub Actions without needing long-lived API tokens. The idea was to reduce the risk of leaked credentials.

The problem was what happened when a GitHub organisation was deleted or abandoned. An attacker could register the same organisation name and, if the npm package still pointed to it through Trusted Publishing, push malicious updates as if they owned it. It worked because npm checked the organisation name, not whether the same people controlled it.

Think of it like a forwarding address. You move house and set mail forwarding. Years later the forwarding expires, someone else moves into your old address, and your bank statements start arriving at their door. Trusted Publishing was the forwarding service, and when the original address changed hands, the mail kept coming.

The researchers found 1,551 npm packages open to this attack, with a combined 10.5 million downloads ^[1]. They reported it responsibly. GitHub and npm shipped fixes in September and October 2026, before the disclosure.

What the attackers could do

Once an attacker controlled the GitHub organisation, they could:

• publish a new version of the package with malicious code,
• push it through the same Trusted Publishing workflow the original maintainer had set up,
• reach every project that installed the package and didn't pin versions.

No stolen tokens, no phishing, just a name registration. The attack was quiet and, until someone checked the new release, invisible.

The fix

GitHub now checks that the organisation ID matches, not just the name ^[1]. If the organisation is deleted and recreated, the ID changes, and Trusted Publishing stops working until the package maintainer updates the link.

npm is also checking packages that used Trusted Publishing and had recent activity from reclaimed organisations.

What this means for you

If you maintain packages on npm:

• Check whether you use Trusted Publishing and whether your linked GitHub organisations still exist under the same ownership.
• Review recent releases of your dependencies, especially if they come from organisations with few active maintainers.
• Pin dependency versions in production and test updates before deploying them.

If you run software that pulls from npm:

• Audit your dependencies. Tools like npm audit won't catch this, because the malicious version would have a valid signature from the original workflow.
• Ask whether you need every dependency. Each one is a door.

Sealing releases as they happen

Supply chain attacks often turn on one question: was this the version we tested, or did someone slip in a change along the way?

Here, the thing to seal is each package release: the build fingerprint, the commit hash it came from and the release notes. Sealing happens at the point of publishing, through the same workflow that builds the package. The release itself stays on npm; what gets sealed is a fingerprint and a timestamp.

Later, when someone questions a release, anyone with access to the sealed record can check that the version they installed matches the one that was published, unchanged. It doesn't show that the release was safe, but it does show whether it is the same artefact that left your build pipeline.

A digital witness per release gives you a timeline nobody can rewrite. That includes you. If an attacker pushes a malicious version through a compromised workflow, the sealed record will show it happened, and when. WitniumChain does this through a REST API, an SDK or an MCP server. The content never leaves your systems; what gets sealed is a fingerprint. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Your build pipeline seals the release fingerprint, commit hash and notes when the package is published.
2. The fingerprint is sealed on a chain where any later change would show.
3. When someone questions a release, they calculate the fingerprint again and check it against the sealed one.

What to watch

The Cyber Resilience Act will require manufacturers of products with digital elements to report actively exploited vulnerabilities and serious incidents, with tight deadlines, from 11 September 2026 ^[2]. For software, that includes npm packages if they are sold or otherwise made available.

From 11 December 2027, the same regulation's security requirements apply, including logging and monitoring of security-relevant events ^[3]. An incident like Slugfest would fall squarely within those duties.

Sources

^[1] "Slugfest: npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover", Help Net Security, 13 October 2026, https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/

^[2] Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 14, https://eur-lex.europa.eu/eli/reg/2024/2847/oj

^[3] Regulation (EU) 2024/2847 (Cyber Resilience Act), Annex I, https://eur-lex.europa.eu/eli/reg/2024/2847/oj