npm trusted publishing could accept a reclaimed repository slug as package authority

A signed provenance statement can be authentic without referring to the right publisher. SlugFest examined a trusted-publishing binding that recognized a GitHub organization, repository name and workflow. If the original repository slug was abandoned and a different user could claim it, a new workflow might present an authentic GitHub OIDC assertion with the same textual identity. The registry could accept that assertion as authority to publish the original npm package, without a stolen password or a compromised GitHub key.

Bloom Security reported more than 1,500 potentially exposed packages and large aggregate historical download figures. These numbers describe candidates and usage, not confirmed package takeovers or poisoned installations. They also do not show that every affected configuration remained exploitable after registry changes. The difference between an immutable GitHub repository identifier and a reusable display slug is central to the trust failure.

GitHub announced expiration of configurations left unvalidated for 48 hours, reducing one exposure period. Verification must still ask what identity a validated binding retains after repository renames, transfers and deletions. Cryptographically valid attestations only prove that the named issuer signed the event; they do not establish continuity of ownership when the issuer identifier itself can be reclaimed.