The issue is now fixed, Bloom Security researcher Golan Myers told CSO. “The npm team confirmed that a fix had been shipped on October 2, introducing a 48-hour expiry for unvalidated Trusted Publishing configurations,” he said.
Myers said Bloom has not observed active exploitation in the wild, but confirmed that the flaw was successfully used to publish a new version of an existing npm package under their own controlled testing conditions. The fix addresses the exposure associated with unvalidated configurations, although maintainers still need to review their existing trust relationships, Bloom wrote in a blog post shared with CSO ahead of its publication on Tuesday.
A reclaimed repository name enabled package publishing
npm’s Trusted Publishing allows package maintainers to publish releases through automated workflows using OpenID Connect (OIDC), avoiding long-lived publishing credentials. However, Bloom found that npm’s trust configuration relied on the GitHub repository’s owner/repository name instead of its immutable repository ID.
