Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover
· Source: hackernoon.com
In short
Bloom Security's 'SlugFest' research found that npm's Trusted Publishing relied on human-readable repository slugs rather than GitHub's permanent repository IDs, allowing attackers to reclaim abandoned or renamed repository addresses and inherit publishing rights to legitimate packages. The registry-wide scan identified more than 1,500 vulnerable packages with over 10 million combined downloads, and the issue remained exploitable for more than 120 days after disclosure. The findings are especially significant because AI coding agents install roughly 350 packages per month on developer machines, letting malicious versions spread with limited human scrutiny.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 42, 2026: Planning AI reaches a quantified milestone as Cencora reports 10% forecast improvement
Tags: supply chain, cybersecurity, npm, AI agents, open source, automation