Over 1,500 npm packages exposed by Trusted Publishing validation flaw

A flaw in npm’s Trusted Publishing mechanism, dubbed SlugFest, could have let attackers hijack legitimate packages by reclaiming abandoned GitHub repository names, CSO reports. Bloom Security researchers identified more than 1,500 potentially vulnerable packages, including security scanners and cryptographic tools; npm shipped a fix on October 2 and no active exploitation has been observed.