Bloom Security says npm Trusted Publishing stored only a package's bound GitHub owner/repo slug and workflow file name until the first publish from that binding. If the bound repo or owner was renamed, transferred or deleted, anyone could re-register the slug, add a workflow file with the same name and swap the OIDC token for a valid publish credential (with a Sigstore provenance attestation pointing at the attacker's repo). Bloom counted more than 1,500 exposed packages with over 10M total downloads, and says the same issue affected the GitLab implementation. It reported the flaw via HackerOne on June 6. GitHub's Oct 2 changelog says unvalidated trusted-publishing configurations now expire 48 hours after creation, and a configuration is bound to the repository once its first publish succeeds. npm also now rejects tokens from issue_comment events. Bloom isn't releasing the package list, and no exploitation has been reported.