Wire · opportunities
npm Trusted Publishing Flaw With 10 Million Downloads Exposes 1,500+ Packages to ...
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 13 October 2026 · Fusion42 review
A critical security flaw in npm's Trusted Publishing feature exposed over 1,500 packages with more than 10 million downloads to takeover via reclaimed GitHub repository names, risking malicious code injection in legitimate packages. GitHub fixed the issue by expiring unvalidated Trusted Publishing configurations after 48 hours and restricting token triggers on less secure events.
This Wire brief sits within Fusion42's coverage of Cybersecurity.
◆ ◆ The Wire takeaway
Security teams running CI/CD pipelines with npm must audit and update publishing workflows immediately to avoid takeover via reused GitHub repository names. This flaw forces a rethink of dependency trust and publish event choices to prevent malicious package releases under valid names.
◆ Coverage
1 source · 13 Oct 2026
◆ Related on Wire
◆ Topics