npm SlugFest: How 1,500 Packages Were Open to Takeover — Check Yours (2026)
Trusted publishing was supposed to be the safe way to release npm packages. No long-lived token sitting in a CI secret store waiting to leak — just a short-lived credential minted at release time. On 13 October 2026, researchers at Bloom Security showed it could be abused anyway. They found more than 1,500 npm packages, … Read more