npm Trusted Publishing flaw exposed 1,500+ packages to takeover

Bloom Security found that npm's Trusted Publishing let an attacker publish new versions of someone else's package by registering a freed GitHub repository name. Over 1,500 packages with 10 million downloads were exposed; GitHub shipped fixes and now expires unvalidated configurations after 48 hours.

• Attack needed no stolen credential, only claiming a freed repo slug
• More than 1,500 npm packages with 10 million total downloads exposed
• Malicious version can carry a postinstall script and valid provenance attestation
• GitHub: unvalidated Trusted Publishing configs now expire 48 hours after creation