# Stolen publish token ships backdoor

Publish rights reachable by stolen tokens, compromised accounts, or workflows running untrusted code

_Area: Software supply chain and CI/CD. Seen in 9 disclosed reports; latest 2026-10-22. Updated 2026-10-23._

## How it works
Publishing a package version is a privileged action, but the right to do it is often held by a long-lived token, a maintainer account, or a CI workflow that trusts whatever code reaches the publish step. The broken assumption is that only reviewed, trusted code can trigger a release. When a token is stolen, an account is compromised, or a workflow runs attacker-influenced code while holding publish secrets, the attacker inherits the publish right and ships a version that looks legitimate because it came from the real pipeline [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-compromised-asyncapi-npm-packages.md)[E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)[E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md).

## Where it shows up
- `pull_request_target` workflows with path filters that run fork code with repo secrets [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-compromised-asyncapi-npm-packages.md)
- Long-lived npm/PyPI tokens still valid alongside OIDC trusted publishing [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md)
- Workflows with `on: push: branches: ['*']` plus `id-token: write` [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md)
- Orphan commits or direct pushes to the default branch bypassing review [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md)[E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md)
- Release workflow repointed to a lookalike repo or build config changed away from the git tag [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)
- Force-pushed mutable tags on shared actions [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md)
- Compromised service accounts or org-owner tokens overriding branch protection [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md)

## How to review
The invariant: every published artifact must trace to reviewed source through a credential that cannot be obtained by running untrusted code. Check that publish credentials are short-lived and scoped to a protected environment; that no workflow executing fork or PR-controlled code holds publish secrets; that registry metadata (`_npmUser`, `trustedPublisher`, `gitHead`) and provenance source URIs match the expected pipeline and commit [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)[E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md); and that commits touching key-handling or release code are reviewed even under trusted identities [E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md). Diff published contents and build config against the source repo and git tag [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)[E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md).

## Variants seen
- PwnRequest in docs CI steals release bot token, then publishes [E1](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-compromised-asyncapi-npm-packages.md)
- Stolen org-owner token repoints trusted release workflow to a lookalike repo [E2](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md)
- Stolen long-lived npm token bypasses OIDC trusted publisher [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md)
- Compromised employee account pushes orphan commits with OIDC workflow [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md)
- Compromised service account force-pushes tags and workflows [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md)
- Compromised maintainer publish creds ship loader plus bundled binary [E6](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-supplychain-local-memtensor-npm-pypi.md)
- Direct commits to master under maintainer identity ride trusted OIDC pipeline [E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md)
- Stolen GitHub CLI OAuth tokens trigger and approve the release workflow [E8](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-litellm-compromised-steals-credentials.md)

## Why fixes fail
OIDC trusted publishing does not help if a long-lived token still exists [E3](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md), and it amplifies repo write access into a valid release [E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md). Review gates fail when commits land directly on the default branch or via orphan commits [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md).

## Impact and severity
High: backdoored releases reached real users, harvesting cloud, wallet, and CI credentials [E6](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-supplychain-local-memtensor-npm-pypi.md)[E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md)[E8](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-litellm-compromised-steals-credentials.md). Severity rises with trusted-publisher pipelines (repo write alone suffices [E7](https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md)), broad namespace reach [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md), and self-propagation [E6](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-supplychain-local-memtensor-npm-pypi.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-compromised-asyncapi-npm-packages.md
- E2: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer.md
- E3: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan.md
- E4: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages.md
- E5: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-trivy-compromised-teampcp-supply-chain-attack.md
- E6: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-supplychain-local-memtensor-npm-pypi.md
- E7: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys.md
- E8: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-litellm-compromised-steals-credentials.md