npm Trusted Publishing Flaw With 10 Million Downloads Exposes 1,500+ Packages to Malicious Takeover

A security flaw in npm’s Trusted Publishing feature exposed more than 1,500 packages to possible takeover through reclaimed GitHub repository names. The affected packages accounted for more than 10 million total downloads and over one million downloads per month, creating a serious software supply-chain risk for developers, CI/CD systems, and organizations that rely on npm dependencies. The issue, named SlugFest, did not require an attacker to steal an npm token, break into a maintainer’s npm account, or access the original GitHub repository. Instead, a threat actor could claim an abandoned GitHub owner/repository name and use it to receive…