Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker …
First seen on helpnetsecurity.com
Jump to article: www.helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw/
