npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

T2Covered by 1 source · first reported by Help Net Security at 13 Oct, 09:00 UTC

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages…