GitHub Limits npm Trusted-Publishing Flaw After 1,500+ Packages Found at Risk
Summary
GitHub now expires unvalidated npm trusted-publishing configurations after 48 hours. The change addresses a flaw that let attackers reclaim abandoned GitHub repository names to publish malicious versions of packages; researchers found over 1,500 vulnerable packages.
Key points
- Attackers could reclaim an abandoned GitHub repository name referenced by an unvalidated npm trusted-publisher configuration and publish a malicious version under the legitimate package name.
- The flaw affected configurations that had not yet completed a successful publish, because npm initially relied on a repository name rather than GitHub's immutable repository ID.
- Bloom Security identified over 1,500 vulnerable packages with more than 10 million combined downloads.
- GitHub now requires a newly created configuration to complete its first successful publish within 48 hours; that publish validates the configuration and binds it to the repository's immutable identity.
- GitHub also rejects trusted-publishing tokens from GitHub Actions issue_comment events, in addition to the existing pull_request_target restriction.
- The researchers warned that malicious packages could spread through dependent projects, including those where AI agents automatically resolve and install the latest package versions.
Article Details
- Vulnerability Types
- Trusted-publishing trust is bound to a reusable repository slug rather than an immutable repository ID until the first successful package publish, allowing a reclaimed slug to inherit trust and publish malicious package versions.
- Extension packs can reference non-existent extensions, allowing an attacker to claim an unclaimed namespace and publish code that is installed alongside the pack.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
People
Vendors
Products
GitHub Actionsname that changes ownership, GitHub said, adding npm also rejects trusted publishing tokens from GitHub Actions issue_comment events going forward, along with the Existing pull_request_target restriction.npmGitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user'sOpen VSXchain attack vectors have been discovered. Earlier this August, Bloom Security also found that both Open VSX and Microsoft's VS Code Marketplace allowed extension packs to reference non-existent extensions in theVS Code Marketplacebeen discovered. Earlier this August, Bloom Security also found that both Open VSX and Microsoft's VS Code Marketplace allowed extension packs to reference non-existent extensions in the marketplaces.