ProductNot yet confirmed elsewhere1 publisher2 min readPublished
Bloom Security finds 1,500 npm packages vulnerable to a publishing attack that needs no stolen credentials
Bloom Security found more than 1,500 npm packages, with over 10 million downloads, vulnerable to a publishing attack that needs no stolen credentials. Bloom also put AI-agent installs at about 70 packages a month on a typical endpoint, but its demonstration used only repositories its researchers controlled.
The Product Desk
Key figures: a typical endpoint receives about 70 packages installed by AI agents a month, and developer machines can approach 350. The average endpoint runs 3 agents; developer machines can run 5 or more.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Agent installs a month, typical endpoint, about | 70 packages | 3 | |
| Developer machines, can approach | 350 packages | agent-installed packages a month | 4 |
| Average endpoint | 3 agents running | 7 | |
| Developer machines | 5 agents or more | 7 |
What happened
- npm Trusted Publishing swaps long-lived tokens for short-lived credentials, but Bloom found npm first tied trust to a repository's slug and did not immediately record its permanent identifier.
- If an owner renames, transfers or deletes a repository, the old address can be claimed by someone else, and a binding that has never published may still accept the new holder.
- A malicious release carrying a postinstall hook can run its code during installation on developer machines or continuous integration systems.
- Bloom reported catching and blocking a customer's AI agent as it tried to install one of the affected packages.
Why it matters
- exposure A malicious release under a legitimate name keeps its download counts and dependency links, so an agent resolving the latest version without a person checking its origin sees an ordinary update.
- constraint Controls that watch for stolen maintainer credentials or account takeovers would see nothing here, because Bloom says the route involves neither.
- decision Whoever owns developer tooling now has to decide which environments let agents install new package versions on their own.
Take a developer who asks an assistant to add a library and goes back to the ticket. The agent picks a package, installs it and moves on. Bloom says users hand installs to agents that each put in between 0.3 and 1.2 packages a day, depending on type [5]. The average endpoint runs three such agents [7], and those counts leave out the dependencies the installed packages bring in [8].
The endpoint figure holds up on Bloom's own inputs. Three agents at 0.3 to 1.2 packages a day come to 27 to 108 installs over a 30-day month, and the reported 70 sits inside that range [20][3]. The 350 for developer machines is harder to rebuild [4]. Two to three direct installs a day is 60 to 90 a month [21], and five agents at the 1.2 ceiling reach 180 [22]. The source does not show how 350 is built, so we would plan on 70 and treat 350 as an outer case.
Bloom demonstrated the publish on repositories and a package scope it controlled [15]. The account does not say how many of the 1,500 packages have a claimable slug today, or whether any malicious release has appeared.
Readers need to decide which environments let agents install without a second look. Bloom says no person necessarily reviews a package's origin or release history before an agent installs the latest version [17], and packages may run install scripts, including postinstall hooks, without a developer reviewing each dependency [9]. Sort each environment where agents install packages on two points: whether a person or a policy checks a new version before the install, and whether install scripts can run there.
An environment with at least one of those controls has something in the path. One with neither is the one to fix first. We would pick the control by its cost. Blocking install scripts turns every package with a legitimate script into an exception that someone has to approve. A hold or approval step on new versions slows the agent. Attestation is a poor candidate for the control, since Bloom flags a potential blind spot in provenance verification [19].
What to watch
- Whether npm now records the permanent repository identifier when a Trusted Publisher binding is created; Bloom says it initially did not.
- Whether any of the 1,500 affected packages ships a malicious release, which would move this from a demonstration to an incident.
- Whether Bloom publishes how it arrives at 350 monthly installs for developer machines, since the daily rates it reports give 60 to 90.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption20
- Hype gap+25
- Incentives65
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The SlugFest research identified more than 1,500 npm packages vulnerable to a publishing attack involving GitHub repository addresses.
- [2]
Together, the vulnerable packages had accumulated more than 10 million downloads.
- [3]
Bloom found that a typical endpoint receives approximately 70 packages installed by AI agents each month.
- [4]
Developer machines can approach 350 agent-installed packages a month.
- [5]
Bloom studied millions of AI agents across dozens of organizations and found individual agents install between 0.3 and 1.2 packages per day, depending on the agent type.
- [6]
Developer machines experience two to three direct package installations daily.
- [7]
The average endpoint runs three agents across command-line interfaces, IDEs, extensions, and assistants; developer machines can run five or more.
- [8]
The reported install figures do not include the additional dependencies that directly installed packages bring in.
- [9]
Packages may execute installation scripts, including postinstall hooks, without a developer individually reviewing every dependency.
- [10]
Bloom reported catching and blocking a customer's AI agent attempting to install one of the packages affected by the vulnerability.
- [11]
npm Trusted Publishing is designed to improve security by replacing long-lived publishing tokens with short-lived credentials.
- [12]
Bloom found that npm initially established the trust relationship using a GitHub repository's human-readable address, or slug, and did not immediately record its permanent repository identifier.
- [13]
When owners rename, transfer, or delete repositories, their previous addresses can become available for someone else to claim; a package's Trusted Publisher binding may still reference the old address and may not yet have produced a successful publication, so another repository could potentially satisfy the original trust configuration.
- [14]
The resulting route to publishing access does not depend on stealing the legitimate maintainer's credentials or compromising their GitHub account.
- [15]
Bloom demonstrated the issue using researcher-controlled GitHub repositories and an npm package under a researcher-owned scope, successfully publishing to the package from a second repository belonging to another organization.
- [16]
Once an attacker obtains publishing access, they can release a malicious version under the legitimate package name, and existing download counts, reputation, and dependency relationships remain associated with that name.
- [17]
AI agents may automatically resolve dependencies and install the latest available versions, and no person necessarily reviews every package's origin or release history.
- [18]
If a malicious release includes a postinstall hook, its code can execute during installation on developer machines or continuous integration systems.
- [19]
The research also identifies a potential blind spot in provenance verification.
- [20]
Three agents at 0.3 to 1.2 packages a day over a 30-day month come to 27 to 108 installs per endpoint, a range that contains the reported 70.
- [21]
Two to three direct installs a day on a developer machine is 60 to 90 a month, well under the 350 figure.
- [22]
Five agents at the top per-agent rate of 1.2 packages a day reach 180 installs a month, still under 350.
Sources
1 independent publisher whose own reporting we read for this story.
- thenextweb.comHow AI coding tools could amplify software supply-chain attacks
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.