Evidence · DiggingBeagle record
Bloom Security: SlugFest reclaimed repository trusted publisher
Original research on npm trusted publishing repository-slug reuse and observed agent package installation.
- Source role
- primary disclosure
Evidence record
Original research on npm trusted publishing repository-slug reuse and observed agent package installation.
Claim-level citations (1)
- supportsnpm trusted publishing could accept a reclaimed repository slug as package authority: Bloom Security reported that an unvalidated npm trusted-publishing configuration could recognize a newly claimed GitHub repository slug as the issuer of a package that had trusted a prior repository identity.
Technical mechanism and SlugFest by the numbers