npm keyed publishing trust on a renameable owner/repo name instead of GitHub’s immutable repository ID, exposing 1,500+ packages. The bug, the fix, and the same mistake in your own authorization code.
SlugFest: The npm Trusted Publishing flaw that trusted names, not IDs
calendar_today
October 16, 2026
domain
workos