A vulnerability in npm's Trusted Publishing system, disclosed by Bloom Security, put more than 1,500 packages with over 10 million downloads at risk of takeover2. The flaw itself is a conventional infrastructure weakness, but the research that surfaced it began not with credential theft but with a question about how AI coding agents acquire dependencies at enterprise scale1. ANALYSIS Taken together, the SlugFest findings and Meta's simultaneous release of an AI-agent security toolkit suggest the industry is beginning to treat autonomous code agents not just as productivity tools but as a distinct threat surface.
Why it matters
AI agents are now installing software at volumes that outpace human review. Bloom studied millions of AI agents across dozens of organizations and found that a typical endpoint receives approximately 70 packages installed by AI agents each month. Developer machines can approach 350. Individual agents install between 0.3 and 1.2 packages per day depending on type, while developer machines see two to three direct package installations daily. The average endpoint runs three agents across command-line interfaces, IDEs, extensions, and assistants. ◆ At that cadence, a single compromised package can propagate across an enterprise far faster than any human-driven install pattern would allow.
The big picture
The SlugFest research centered on npm Trusted Publishing, a system that lets authorized GitHub Actions workflows publish packages through short-lived OIDC credentials. Bloom found that npm established trust relationships using a GitHub repository's human-readable address, or slug, rather than an immutable identifier. That gap meant an attacker who reclaimed a repository slug could potentially publish a malicious package under a legitimate name without stealing any credentials. Bloom demonstrated the publishing path using researcher-controlled repositories and an npm scope it controlled. The team successfully published to the package from a second repository belonging to another organization.
Bloom's registry-wide scan identified more than 1,500 vulnerable packages accounting for more than 10 million downloads. The company reported catching and blocking a customer's AI agent attempting to install one of the vulnerable packages. Bloom disclosed the issue through GitHub's HackerOne program on June 6, 2026. GitHub triaged and validated the vulnerability on June 9, 2026. The last response before the eventual fix came on July 8, 2026. npm subsequently confirmed the remediation and apologized for the delayed communication. The issue also affected npm's GitLab Trusted Publishing implementation.
Bloom's proposed fix was to store immutable repository and owner identifiers when establishing trust, then verify the repository identifier in the OIDC token during publishing authorization. The researchers noted that PyPI's Warehouse already follows this approach.
Meanwhile, Meta released Zurp, an open-source toolkit connecting Burp Suite with AI coding agents for approved bug bounty research3. Zurp works as a Java extension inside Burp Suite and offers Model Context Protocol servers for AI agents. The tool is restricted to data and test assets linked to a researcher's own authorized account. ANALYSIS Where Bloom's research quantifies the defensive gap that AI agents create, Meta's Zurp represents an early attempt to channel those same agents into structured, bounded security work.
Between the lines
Bloom was explicit that AI agents are not the root cause of the vulnerability. The slug-reuse flaw existed independently of any agent behavior. ◆ But the research framing is deliberate: Bloom built its case around agent installation telemetry precisely because the volume and autonomy of those installs change the blast radius of a publishing-infrastructure weakness. Developer machines that can run five or more agents create compounding exposure that static dependency audits were never designed to catch.
Bloom recommends auditing software used across the organization, including packages and extensions introduced through AI workflows. The company advises using "npm trust list" to review publishing relationships and confirming that each repository slug still resolves to a repository under the maintainer's control. Teams should consider supply chain controls that inspect or restrict software installation alongside clear policies governing AI agent usage.
ANALYSIS Meta's Zurp release carries a complementary signal. By wrapping agent access inside Burp Suite's traffic-inspection layer and limiting scope to authorized accounts, the toolkit implicitly acknowledges that AI agents operating in security contexts need hard boundaries, not just guidelines.
What's next
npm has confirmed its remediation, but Bloom advises removing or recreating trust bindings after repository changes. ◆ The broader question is whether other package registries relying on mutable identifiers for trust relationships face analogous exposure. PyPI's use of immutable identifiers offers a reference model, and registries that have not adopted a similar approach now face pressure to explain why.