Key points
- Over 1,500 npm packages with more than 10 million downloads are vulnerable to the SlugFest publishing attack.
- Enterprise endpoints receive approximately 70 AI-installed packages monthly, creating new supply-chain risks.
- The flaw exploits GitHub Actions OpenID Connect tokens within npm's Trusted Publishing infrastructure.
A vulnerability named SlugFest exposes more than 1,500 npm packages to potential publishing attacks, according to research from Bloom Security. These packages have collectively recorded over 10 million downloads. The flaw allows attackers to inject malicious code into the software supply chain without stealing user credentials, intersecting with automated developer workflows that increasingly rely on artificial intelligence for package installation.
In plain English
The vulnerability stems from weaknesses in npm Trusted Publishing, a system designed to secure package distribution. Instead of using long-lived tokens, this mechanism uses short-lived credentials generated by GitHub Actions workflows. These workflows obtain OpenID Connect tokens from GitHub to authenticate publishing requests. The research demonstrates how these automated authentication steps can be manipulated to publish unauthorized updates, bypassing traditional credential-based security controls.
The background
Bloom Security analyzed the scale of AI-driven software installation across large enterprises to understand the risk exposure. The study found that a typical enterprise endpoint receives about 70 packages installed by AI agents each month. Developer machines face higher volumes, approaching 350 packages monthly. Individual AI agents install between 0.3 and 1.2 packages per day, while developer machines see two to three direct installations daily.
What changes now
The average endpoint runs three AI agents across various interfaces, including command-line tools and IDEs. Developer machines often run five or more agents. These figures exclude additional dependencies that installed packages bring in, meaning the total software footprint is larger than reported. This volume creates more opportunities for untrusted code to enter environments, especially since packages may execute installation scripts without individual developer review.
Background: Supply chain attacks
Supply chain attacks compromise trusted software or hardware before it reaches you. Attackers inject malicious code into updates or dependencies, allowing them to enter your network through legitimate channels. You must verify digital signatures and limit privileges to stop this silent infiltration.
Read the full guide: Supply Chain Attacks: How Compromised Dependencies Breach Your Network
What to do and how to stay safe: npm
- Audit your npm package dependencies to identify if any of the 1,500 affected packages are in use.
- Monitor AI agent activities for unexpected package installations or postinstall script executions.
- Review GitHub Actions workflows to ensure they follow strict security protocols for publishing.
- Implement stricter controls on automated package installations within your enterprise environments.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many npm packages are affected by the SlugFest vulnerability?
Bloom Security identified more than 1,500 npm packages vulnerable to the publishing attack.
What is the estimated number of AI-installed packages per endpoint monthly?
A typical enterprise endpoint receives approximately 70 packages installed by AI agents each month.
Does this vulnerability require attackers to steal user credentials?
No, the vulnerability can potentially expose organizations to malicious code without requiring attackers to steal credentials.
