SlugFest npm Flaw Put 1,500+ Packages at Hijack Risk
In short: On October 13, 2026, researchers at Bloom Security disclosed a vulnerability dubbed SlugFest in npm's Trusted Publishing mechanism. The system trusted a human-readable GitHub repository name instead of its permanent numeric identifier — so if a package maintainer renamed, deleted, or transferred a repository and the old name became free, anyone could re-register it on GitHub and inherit the right to publish new versions of someone else's package, without stealing a single password or token. More than 1,500 npm packages with over 10 million combined downloads were exposed, including security scanners and cryptographic libraries. npm shipped a fix on October 2; researchers found no evidence of active exploitation in the wild.
What SlugFest is and why it worked
Trusted Publishing is a relatively new npm feature that links a package publish directly to a specific GitHub repository via an OIDC token, removing the need for a long-lived npm token in CI. The problem: npm validated this link using a "slug" — a human-readable string like owner/repo — rather than GitHub's immutable numeric IDs for the owner and repository, which survive renames and ownership transfers. When a maintainer renamed an account or repository, deleted it, or transferred it to someone else, the old slug became available — and an attacker could register the same name on GitHub, inheriting npm's publishing trust tied to the original package's identity.
Scope and a confirmed proof of concept
According to Bloom Security, more than 1,500 npm packages were vulnerable this way, with combined downloads exceeding 10 million and over 1 million downloads per month — among them authentication tools, security scanners, and cryptographic libraries. Researchers confirmed exploitability in a controlled test environment, successfully publishing a new version of an existing package by reclaiming a freed-up repository name. No active exploitation against real users was observed at disclosure time, but the fact that hijacking a package required no stolen credentials at all makes this attack particularly dangerous for the supply chain — it wouldn't show up in routine credential-leak monitoring.
GitHub's response
Following disclosure, GitHub and npm tightened the rules quickly: a newly created Trusted Publishing configuration must now complete its first successful publish within 48 hours, which binds the configuration to the repository's immutable identity rather than its current name. The patch shipped back on October 2 — 11 days before the public disclosure, standard practice for responsible disclosure on a supply-chain flaw of this scale.
Why this matters for everyday users
SlugFest is primarily a problem for developers and organizations that build software from open-source packages: malicious code slipped into a dependency can end up in a company's own product and from there reach its customers. But the software supply chain touches you directly too — nearly any app on your phone, browser extension, or banking service is built on thousands of libraries like these. If an infostealer or backdoor slips into one of them, you can be affected without installing anything manually or clicking a single suspicious link. For more on recognizing and limiting the damage from malware that steals credentials, see our guide to infostealer malware.
How to lower your own risk
- If you're a developer, use lock files (
package-lock.json) and pin dependency versions instead of auto-updating to the latest major release. - Enable two-factor authentication on your GitHub and npm accounts if you publish your own packages — it doesn't stop SlugFest directly, but it closes off the classic account-takeover vectors.
- For everyday users: keep different passwords for different services via a password manager, so a credential stolen from one compromised app doesn't open the door to everything else. See our password manager guide for details.
- Watch for official security update notices from apps you use regularly, and don't delay installing patches.
SlugFest itself is a server-side development infrastructure issue, and a VPN isn't a defense against it. But when you log into GitHub, npm, or any other developer account from a café, coworking space, or hotel Wi-Fi, encrypting your traffic with LiMP VPN closes a related risk — your login and session tokens being intercepted on someone else's network. Plans start at 69 ₽/month — see pricing.