Your pipeline trusts a name, and names can be claimed: on October 13 Bloom Security showed 1,500+ npm packages with 10M+ downloads open to takeover. Not a single credential stolen.
SlugFest is a flaw in npm's Trusted Publishing, the mechanism sold as the answer to the token-theft wave: "move to OIDC and phishing can't touch you." But publishing trust was bound to a GitHub repository's human-readable name (owner/repo), not its immutable numeric ID. A maintainer renames or deletes a repo — the slug is up for grabs, and anyone can claim it and ship new versions of someone else's package. No stolen npm token, account, or key required. Worse: such a release carried a valid Sigstore signature, issued for the intruder's repository. Any tooling that merely checks whether provenance exists would wave the package through. Checking "has a signature" without checking "signed by whom" lulls you deeper than no signature at all: with no badge, at least you stay wary.
The timeline: reported via HackerOne on June 6, validated June 9, fixed October 2, 120+ days later. Unvalidated configurations now expire after 48 hours, and trust is pinned to the repository's immutable ID on the first successful publish. Here's the contentious part: 120+ days for packages with 10M+ downloads (1M+ a month) isn't a process hiccup — it's a systemic signal. New trust mechanisms ship faster than anyone audits them; the badge arrives before the meaning of the badge.
What this means for a lead. Three checks for today. Audit the trusted-publishing configurations of your own packages: which repository each one points to, and whether it still lives under that name. Bake a rule into your runbooks: "renamed the repo — update the publishing config within the hour"; an orphaned slug is a door left unlatched. And set a dependency-install policy for AI agents: Bloom watched its customers' agents pull vulnerable packages on their own — with no human in the loop, any registry flaw scales itself. Primarch Cognitus will have his own say on agents.
No panic: Trusted Publishing still beats long-lived tokens. But trust is a chain, not a badge. Inspect every link — especially the one that looks the sturdiest.
📎 bloom.security/blog/slugfest-millions-of-ai-agents-download-exposed-npm-packages · docs.npmjs.com/trusted-publishers