SlugFest: How a Repo Rename Could Hand Your npm Package to an Attacker
No Comments on SlugFest: How a Repo Rename Could Hand Your npm Package to an Attacker
Bloom Security found that npm trusted publishing trusted a repository's name instead of its permanent ID until the first publish, leaving 1,500+ packages open to hijacking. GitHub has now added a 48-hour validation window, but maintainers still have…