# package-registry-security

Published articles for package-registry-security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover

DevFeed: [Bloom Security Found a Supply-Chain Vulnerability Exposing 1,500 npm Packages to Malicious Takeover](<https://devfeed.tech/articles/bloom-security-found-a-supply-chain-vulnerability-exposing-1-500-npm-packages-to-malicious-takeover-86076.md>)

Original publisher: [Read original article](<https://hackernoon.com/bloom-security-found-a-supply-chain-vulnerability-exposing-1500-npm-packages-to-malicious-takeover?source=rss>)

Author: Kevin John

Published: 2026-10-13T10:03:02Z

Content type: news

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [software supply-chain attack](<https://devfeed.tech/topics/software-supply-chain-attack.md>), [axios supply chain attack](<https://devfeed.tech/topics/axios-supply-chain-attack.md>), [axios npm attack](<https://devfeed.tech/topics/axios-npm-attack.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [npm security](<https://devfeed.tech/topics/npm-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [npm-workspaces](<https://devfeed.tech/topics/npm-workspaces.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Reverse Dependencies](<https://devfeed.tech/topics/reverse-dependencies.md>)

Tags: [bloom-security](<https://devfeed.tech/tags/bloom-security.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-actions-oidc](<https://devfeed.tech/tags/github-actions-oidc.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [npm-supply-chain-attacks](<https://devfeed.tech/tags/npm-supply-chain-attacks.md>), [npm-trusted-publishing](<https://devfeed.tech/tags/npm-trusted-publishing.md>), [openid-connect-security](<https://devfeed.tech/tags/openid-connect-security.md>), [package-registry-security](<https://devfeed.tech/tags/package-registry-security.md>), [security](<https://devfeed.tech/tags/security.md>), [slugfest-vulnerability](<https://devfeed.tech/tags/slugfest-vulnerability.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>)

### AI overview

Bloom Security found a flaw in npm Trusted Publishing that could let an attacker reclaim a GitHub repository address and inherit publishing trust for certain packages. A scan identified more than 1,500 vulnerable packages configured for Trusted Publishing. npm fixed the issue before Bloom published its findings. The report also discusses how AI coding agents and automated dependency installation can increase software supply-chain exposure.

### Source excerpt

Bloom Security uncovered a flaw in npm Trusted Publishing that exposed 1,500+ packages to potential malicious takeovers via GitHub.