npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover

Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credent...