npm Trusted Publishing flaw put 1,500 packages at risk of takeover

GitHub has changed npm Trusted Publishing so unused configurations expire after 48 hours, addressing a flaw that put more than 1,500 packages at risk of takeover. Attackers could claim an abandoned GitHub repository name and publish under a package’s legitimate npm name—without stealing credentials. The exposed packages have more than 10 million downloads combined.
Source

👉@sysadminoff

https://4sysops.com/archives/npm-trusted-publishing-flaw-put-1500-packages-at-risk-of-takeover/