npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind…

Preview courtesy of Help Net Security. The full article opens on their site.