npm Trusted Publishing flaw left 1,500+ packages open to takeover via renamed repos
Bloom Security found npm bound Trusted Publishing to GitHub repository names rather than permanent IDs, letting attackers who claimed abandoned names publish versions of packages they did not own.