npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

What happened

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes.

The attacker only needed to register a GitHub repository name the maintainer had left behind. The exposed packages have more than 10 million downloads in total and more than a million a … More → The post npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover appeared first on Help Net Security .

Key facts

• Bloom Security researchers — found: that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential