# SlugFest: npm trusted publishing trusted repository names, so reclaimed names could publish

Source: https://startwithidentity.com/blog/2026-10-13-npm-trusted-publishing-slugfest-let-reclaimed-repo-names-publish-packages/
Last updated: 2026-10-13
License: content by Start with Identity. Cite the source URL.

---

Bloom Security disclosed SlugFest on October 13: npm trusted publishing identified the GitHub repository allowed to publish a package by its owner/repository name, and only stored the permanent numeric repository ID after the first successful publish. If a maintainer configured trusted publishing and then renamed, transferred or deleted the repository, or the owner account, before publishing from it, anyone could register the freed name, add a workflow with the expected filename, and exchange a GitHub Actions OIDC token for a valid npm publish credential with no maintainer secrets. Bloom counts more than 1,500 exposed packages with over 10 million total downloads and reports no confirmed exploitation. It reported the issue on June 6. GitHub's October 2 changelog makes unvalidated configurations expire 48 hours after creation and also rejects trusted publishing tokens from `issue_comment` workflow events.

## Why it matters

Trusted publishing replaces long-lived npm tokens with short-lived [OIDC](https://startwithidentity.com/glossary/oidc/) exchanges, which is the right direction, but the trust is only as good as the identifier it binds to. A name that can be released and reclaimed is not an identity. This is the same lesson as [orphaned accounts](https://startwithidentity.com/techniques/orphaned-account-abuse/): the binding outlived the thing it pointed at.

Maintainers should run `npm trust list`, confirm every bound repository still exists under their control, delete and recreate bindings after any rename or transfer, remove bindings before deleting a repository, and publish once immediately after creating a new binding so it locks to the numeric ID. Watch for publishes you did not start. The same check applies to [workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/) trust policies in cloud accounts that match on repository name. Bloom's write-up is [here](https://bloom.security/blog/slugfest-millions-of-ai-agents-download-exposed-npm-packages) and GitHub's change is in the [changelog](https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire/).

Source: [The Hacker News](https://thehackernews.com/2026/10/github-tightens-npm-publishing-after.html)