Author: DigitalSpying Cyber Threat Research Team | Date: October 13, 2026
Category: Software Supply Chain Security, Package Registry Security, OIDC & Authentication Architecture, Open Source Security
________________
Executive Summary
On October 13, 2026, cybersecurity researchers at Bloom Security published technical details regarding "SlugFest," a fundamental authorization flaw discovered in npm’s flagship "Trusted Publishing" mechanism. The vulnerability allowed threat actors to achieve zero-credential package takeovers on a massive scale, as reported by Help Net Security: npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover.
Trusted Publishing was originally introduced by GitHub and npm as a tokenless OpenID Connect (OIDC) publishing architecture. Its goal was to modernize open-source publishing security by replacing static, long-lived API tokens with short-lived, cryptographically signed identity assertions tied directly to Continuous Integration / Continuous Deployment (CI/CD) workflows.
However, security researchers identified a architectural design flaw: npm’s backend authorization engine verified incoming OIDC tokens against mutable, human-readable repository slugs (the owner/repo string) rather than immutable numeric repository identifiers (repository_id).
When an open-source maintainer renamed an organization, transferred a repository, or deleted a repository bound to Trusted Publishing, the underlying string slug became available on GitHub. Threat actors could claim the abandoned slug, register a matching workflow file on GitHub Actions, and automatically receive valid publishing credentials from npm.
Impact Overview
* Zero-Credential Hijacking: No stolen API keys, compromised developer laptops, or phished credentials were required.
* Widespread Exposure: Over 1,500 published npm packages were confirmed vulnerable to instant takeover.
* Massive Blast Radius: Affected packages account for more than 10 million cumulative downloads and over 1 million monthly active installations across public software pipelines.
* Remediation Status: GitHub and npm deployed server-side authorization fixes to enforce validation against permanent, immutable numeric IDs.
________________
Technical Deconstruction of the SlugFest Flaw
The Mechanics of npm Trusted Publishing
Trusted Publishing was created to dismantle the primary attack vector targeting open-source maintainers: credential theft. Historically, maintainers generated long-lived npm API tokens and manually injected them into CI/CD secrets (e.g., GitHub Actions Secrets). If a maintainer's account was compromised, or if secret variables leaked during pipeline execution, attackers could publish malicious package updates instantly.+-----------------------------------------------------------------------------------+
| OIDC Token Exchange Process |
|---|
| |
| [ GitHub Actions Pipeline ] --(1. Requests Token)--> [ GitHub OIDC Provider ] |
| |
| [ GitHub OIDC Provider ] --(2. Issues Signed JWT)--> [ GitHub Actions Pipeline ] |
| |
| [ GitHub Actions Pipeline ] --(3. Passes JWT)------> [ npm Registry Endpoint ] |
| |
| [ npm Registry Endpoint ] --(4. Verifies Claims)--> [ Validated or Rejected ] |
| |
+-----------------------------------------------------------------------------------+
1. OIDC Federation: When a GitHub Actions workflow executes npm publish, the runner requests a short-lived JSON Web Token (JWT) from GitHub's internal OIDC Identity Provider (IdP).
2. Token Generation: GitHub’s IdP mints a cryptographically signed JWT containing specific claims about the execution environment.
3. Token Exchange: The GitHub Actions runner submits this JWT to npm's token exchange endpoint (/upload/-/npm/v1/security/advisories / publishing APIs).
4. Validation: npm verifies the token's cryptographic signature against GitHub’s public OIDC keys, parses the claims, checks whether the claims match a registered Trusted Publisher, and issues a temporary publishing session.
The Failure: Mutable Slugs vs. Immutable Identifiers
GitHub's OIDC implementation includes both mutable string references and immutable system identifiers within the JWT payload. The structural vulnerability stemmed entirely from npm’s backend verification logic.{
"iss": "https://token.actions.githubusercontent.com",
"aud": "https://registry.npmjs.org",
"sub": "repo:alice/cool-pkg:environment:npm-publisher",
"repository": "alice/cool-pkg",
"repository_owner": "alice",
"repository_id": "84729104",
"repository_owner_id": "1948201",
"ref": "refs/heads/main"
}
While GitHub supplied repository_id and repository_owner_id within every issued token, npm’s authentication service evaluated only the repository string claim.
When a repository was renamed from alice/cool-pkg to alice/legacy-pkg, or if the user account alice changed to alice-org, GitHub released the string namespace alice/cool-pkg. However, the npm registry database retained the rule: "Allow any valid OIDC token claiming repository == 'alice/cool-pkg' to publish package updates."
The Attack Lifecycle (End-to-End Execution)
An attacker exploiting the SlugFest vulnerability followed a simple, deterministic multi-step process:[Legitimate Maintainer: Renames / Deletes Repo (e.g., 'alice/cool-pkg')]
│
▼ (npm Registry retains Trusted Publishing binding to slug 'alice/cool-pkg')
│
[Attacker: Registers Vacant Slug 'alice/cool-pkg' on GitHub]
│
▼ (Commits Workflow File with Matching Filename)
│
[GitHub Actions Runner: Requests OIDC Token for 'alice/cool-pkg']
│ ├─► GitHub IdP includes 'repository: alice/cool-pkg' (Matches Slug)
│ └─► GitHub IdP includes new 'repository_id' (Unchecked by npm!)
│
▼ (npm Validates Slug Only -> Grants Ephemeral Publish Credential)
│
[Attacker Publishes Malicious Version with Postinstall Script]
└─► Bonus: Package carries authentic, cryptographically signed Provenance Attestation!
1. Reconnaissance: The attacker scanned the npm registry for packages configured with Trusted Publishing, cross-referencing their linked GitHub repository slugs against GitHub’s HTTP 404 Not Found response codes or redirected paths.
2. Namespace Reclamation: The attacker registered the abandoned GitHub username or created a new repository matching the precise freed slug (e.g., alice/cool-pkg).
3. Workflow Replication: The attacker committed a basic GitHub Actions workflow file matching the path and environment expected by the original Trusted Publishing rule (e.g., .github/workflows/publish.yml).
4. Token Request: Upon push, GitHub Actions invoked the OIDC provider. Because the workflow was running inside a legitimate repository owned by the attacker named alice/cool-pkg, GitHub minted a fully authentic, cryptographically valid OIDC JWT bearing the claim "repository": "alice/cool-pkg".
5. Authorization Bypass: The attacker’s workflow transmitted this token to npm. npm verified GitHub's signature, confirmed the string alice/cool-pkg matched its internal database, and issued full write access to the associated npm package.
6. Payload Delivery: The attacker published a patch update containing automated post-installation hooks (postinstall in package.json), executing arbitrary code across downstream developer machines, CI/CD runners, and production environments.
________________
The Provenance Attestation Paradox
One of the most concerning aspects of the SlugFest vulnerability was its interaction with Sigstore and SLSA build provenance attestations.
To improve supply-chain transparency, npm supports cryptographically signed provenance. When publishing from a supported CI/CD provider like GitHub Actions, npm generates an attestation linking the published package artifact to the exact source repository commit and workflow run that produced it.+-----------------------------------------------------------------------------------+
| Provenance Verification |
+-----------------------------------------------------------------------------------+
| |
| Attacker Pipeline --> Valid OIDC Token --> npm Accepts Token & Signed Workflow |
| |
| npm Registry --> Mints Authentic Build Provenance (Sigstore/SLSA) |
| |
| Security Scanners --> Reads Provenance --> Flags Package as "VALID & TRUSTED" |
| |
+-----------------------------------------------------------------------------------+
Because the SlugFest attack originated from a real GitHub Actions runner associated with the targeted repository slug, npm generated an authentic, cryptographically valid Build Provenance Attestation.
* Software Composition Analysis (SCA) Blindness: Enterprise security tools, vulnerability scanners, and automated dependency checkers designed to inspect build provenance verified the hijacked release as authentic and legitimate.
* Signed Malware: The attack produced cryptographically signed malicious software. This bypassed supply-chain defenses that relied solely on signature validation to detect unauthorized code modifications.
________________
Blast Radius & Systemic Registry Scope
Metric / Dimension
Extent of Exposure
Identified Vulnerable Packages
1,500+ public npm packages
Total Cumulative Downloads
Exceeds 10,000,000 installations
Monthly Active Installations
Exceeds 1,000,000 active pipeline updates
Primary Platform Affected
npm (via GitHub Actions OIDC integration)
Secondary Systems Affected
npm (via GitLab CI/CD Trusted Publishing integration)
Multi-Platform Architecture Flaw
The research team noted that the vulnerability was not unique to GitHub Actions. npm’s integration with GitLab CI/CD suffered from the same design pattern.
GitLab uses mutable URI path strings (namespace/project-name) alongside permanent, immutable numeric project IDs (project_id). npm’s authorization service initially verified GitLab token claims against the string path rather than the numeric project ID, exposing GitLab-backed npm packages to identical namespace-reclaiming vectors.
Furthermore, as discussed in ecosystem analyses covering software safety—such as coverage in Help Net Security Supply Chain & Software Security News—the risk profile expands significantly when modern automated tooling is involved. Autonomous dependency bots and AI coding agents routinely auto-merge patch releases. Software pipeline integrations that automatically ingest minor/patch updates would have instantly pulled down compromised packages published via hijacked OIDC trust relationships. These risks are explored further in The Next Web: How AI coding tools could amplify software supply-chain attacks.
________________
Remediation, Developer Audit & Enterprise Defense Blueprint
1. Platform-Level Remediation (Deployed)
Following disclosure by Bloom Security, GitHub and npm updated the backend authentication engine.
* Mandatory Numeric Verification: npm’s token exchange engine now extracts and validates repository_id and repository_owner_id (or GitLab's equivalent project_id) against recorded database records.
* Slug Disambiguation: If a repository's numeric ID does not match the stored ID during an incoming OIDC session, the authentication request is rejected immediately, regardless of whether the string slug matches.
2. Developer & Maintainer Action Items
Maintainers should audit their current package publication setups using the npm CLI and dashboard tools:# List all Trusted Publishing configurations bound to your packages
npm trust list
Remove an outdated or obsolete Trusted Publishing binding
npm trust revoke --package
Best Practices for Maintainers:
* Pre-Deletion Cleanup: Explicitly revoke all Trusted Publishing bindings on npm before renaming, transferring, or deleting a repository on GitHub or GitLab.
* Re-bind Existing Workflows: If you have previously renamed a repository, navigate to your package settings on npmjs.com, remove the old Trusted Publishing binding, and re-create it to refresh the underlying immutable system IDs.
3. Enterprise Supply Chain Defense Strategy
Organizations consuming third-party open-source software should implement defensive controls to mitigate zero-credential hijacking vectors:
* Disable Automated Post-Install Execution: Configure enterprise package manager instances (.npmrc) to run with script execution disabled by default:ignore-scripts=true
* Pin Exact Dependencies: Utilize strict lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock) and avoid unpinned wildcard version specifiers (e.g., ^1.2.3 or *) to prevent CI/CD engines from automatically pulling newly published patch releases.
* Repository-Level Verification: When evaluating package provenance, security tooling must look beyond signature validity and compare the underlying repository_id against historic release baselines.
________________
Strategic Verdict
The SlugFest vulnerability highlights an architectural assumption in federated identity models: human-readable names are convenience labels, not identities.
OpenID Connect provides strong cryptographic guarantees, but those guarantees only apply to the specific claims being evaluated. By treating mutable namespace strings as primary identity keys, platforms risk creating structural bypasses in otherwise secure, tokenless authentication systems.
As developer ecosystems move away from static secrets toward federated OIDC architectures, identity verification models must ensure that trust is anchored exclusively to immutable system primitives.