Tag: SlugFest

A renamed GitHub repo could hand attackers a package’s publishing rights

Bloom Security says npm matched workflows to repository names instead of permanent IDs, leaving 1,500 packages exposed.