The available incident reports do not establish that an npm Trusted Publishing flaw exposed 1,500 or more packages. Palo Alto Networks’ Unit 42 described a targeted ChainDrop capability that could exchange a GitHub Actions OIDC token for an npm publishing credential, but said it did not observe that specific path execute. That is evidence of a potential attack through a compromised workflow identity—not proof of a vulnerability in npm’s Trusted Publishing service.
What the reports establish—and what they do not
The headline claim combines two points the cited reports do not verify: a flaw in npm Trusted Publishing and a count of more than 1,500 packages exposed through it. The reports instead describe separate incidents and attack mechanisms. Their figures should not be added together or presented as a single Trusted Publishing exposure.
As an Amazon Associate I earn from qualifying purchases.
- ChainDrop: Unit 42 reported that the worm infected over 400 packages. Its report also described a narrowly targeted workflow-based publishing capability, but said researchers did not observe that path execute.
- Shai-Hulud: GitHub said it removed more than 500 compromised npm packages in response to the September 2025 incident, after receiving notification on September 14. GitHub published that account on September 22, 2025.
- Red Hat: A separate May 2026 incident involved 32 compromised
@redhat-cloud-servicespackages, according to Red Hat.
These are distinct reports, with different dates, campaigns and counts. None substantiates the specific claim that a Trusted Publishing flaw exposed 1,500-plus packages.
Free tools Windows power users keep installed
One-click scans. No signup required.
How npm Trusted Publishing works
Trusted Publishing lets a package maintainer configure a relationship between npm and an authorized CI/CD provider workflow. Instead of relying on a long-lived npm write token stored in CI, the workflow uses OpenID Connect (OIDC) to obtain short-lived credentials for publishing. The identity is intended to be tied to the configured provider and workflow; it does not make that workflow immune to compromise.
#1 Best Overall
As of npm’s documentation accessed October 13, 2026, supported providers are GitHub Actions, GitLab CI/CD and CircleCI. The documented prerequisites are npm CLI 11.5.1 or later and Node.js 22.14.0 or later. Self-hosted runners are not supported under that documentation. Requirements and supported configurations can change, so maintainers should check npm’s current Trusted Publishing documentation when setting up a publisher.
Configuration defaults can depend on when a publisher was created
The same npm documentation describes changes to allowed publishing actions over time: configurations created before May 20, 2026 were automatically allowed to use npm publish; those created before September 3, 2026 required explicit selection of at least one allowed action; and newer configurations defaulted to npm stage publish, with direct publishing selectable. Check the actual package and publisher settings rather than assuming a default based on a generic setup guide.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
What Unit 42 says the ChainDrop workflow path could do
Unit 42 described a path that first checked for a GitHub Actions environment, a repository name containing /opensearch-js, and a workflow reference containing release-drafter.yml. If those conditions matched, the code could request an OIDC token with npm’s registry as its audience and exchange it for a real npm publishing credential. It could then alter a package dependency and sign the package with Sigstore provenance.
The conditions matter: this was not described as a path that could run against any npm package or any workflow. Unit 42 said the capability was implemented but that researchers did not observe it executing. The report also described the worm searching GitHub Actions runner memory for OIDC tokens and runner secrets, and using npm tokens to republish compromised packages. Those credential-theft and republishing behaviors are separate from proof that the targeted Trusted Publishing exchange was used in an attack.
Why valid provenance does not mean a package is safe
Provenance can provide evidence about which repository and workflow produced a package tarball. It does not independently certify that the source code or workflow was benign. If an attacker changes the source or controls code running inside the authorized workflow, the attestation can accurately identify the repository and workflow while the resulting package contains malicious changes.
Unit 42 summarized this distinction: “This is not forged provenance. The attestation says the tarball was built in that repository by that workflow, and that is true.” In other words, provenance helps establish where and how a build was produced; it is not a malware-clean bill of health.
Npm’s documentation says it automatically generates provenance for eligible Trusted Publishing releases from GitHub Actions or GitLab CI/CD when both the repository and package are public. It says CircleCI Trusted Publishing does not currently include provenance, and private repositories do not receive generated provenance. These are documented conditions as accessed October 13, 2026.
Recommended Free Tools
How to reduce publishing risk
For package maintainers
- Review the package’s npm Trusted Publisher settings. Confirm the intended provider, repository and authorized workflow, and check which publishing actions are allowed.
- Protect the release workflow and runner. Restrict who can change release definitions and dependencies, and prevent untrusted pull-request code from reaching a job with publishing permissions or access to sensitive runner data.
- Where supported, move from long-lived write tokens to Trusted Publishing. Test the OIDC setup, then restrict traditional token access and revoke automation tokens that are no longer needed.
- Consider stage-only publishing. Npm’s staged flow lets CI prepare a release while requiring an authorized maintainer to review and approve it with two-factor authentication before it becomes public.
- Use provenance as one verification signal, not as proof that the package is harmless. Review source changes and the workflow that produced a release as well.
Npm’s maximum-security guidance pairs Trusted Publishing with requiring two-factor authentication and disallowing tokens. That approach reduces reliance on reusable credentials, but it does not remove the need to secure the workflow identity and execution environment.
If you suspect a workflow or package was compromised
- Identify the affected package versions and publishing workflows; inspect unexpected releases and repository changes.
- Remove affected package versions where appropriate, and investigate developer endpoints and CI runners that may have exposed credentials.
- Review publishing and repository activity, then revoke or rotate credentials accessible to affected systems. Unit 42 specifically names npm, GitHub, cloud, SSH and automation credentials as potential rotation targets.
What the incident counts mean for npm users
The reports show why short-lived credentials and provenance are valuable but insufficient on their own: publishing security depends on the identity that receives access and the code running under that identity. They do not show that npm Trusted Publishing itself had a flaw affecting 1,500-plus packages. For maintainers, the practical response is to verify the exact publisher configuration, harden the release workflow, limit fallback tokens and add human approval where the release process warrants it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
