WORLDTECH网络安全 单一来源
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
本文目前仅有英文版。
首次报道 来源：Help Net Security + 1 家其他来源最近编辑更新
What happened
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes.
The attacker only needed to register a GitHub repository name the maintainer had left behind. The exposed packages have more than 10 million downloads in total and more than a million a … More → The post npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover appeared first on Help Net Security .
Key facts
- Bloom Security researchers — found: that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential
来源与证据
- Help Net Security 报道来源
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover ↗
https://www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/ - CSO Online 报道来源
Over 1,500 npm packages exposed by Trusted Publishing validation flaw ↗
https://www.csoonline.com/article/4234229/over-1500-npm-packages-exposed-by-trusted-publishing-validation-flaw.html