As cited
Copy frozen at (site build).
vulnerabilities
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security discovered a flaw in npm's Trusted Publishing feature that allowed attackers to push package versions without credential theft, requiring only registration of a GitHub repository name abandoned by the maintainer. The vulnerability affected over 1,500 npm packages with combined downloads exceeding 10 million, and GitHub has released fixes.
Why it matters: Developers using affected npm packages face supply chain risk if attackers injected malicious code through package takeovers; practitioners should verify package integrity and update to patched versions.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security discovered a flaw in npm's Trusted Publishing feature that allowed attackers to push package versions without credential theft, requiring only registration of a GitHub repository name abandoned by the maintainer. The vulnerability affected over 1,500 npm packages with combined downloads exceeding 10 million, and GitHub has released fixes.
Why it matters: Developers using affected npm packages face supply chain risk if attackers injected malicious code through package takeovers; practitioners should verify package integrity and update to patched versions.
- Source published
- First seen by Cybersecurity Tracker