npm checked the repository's name, and a name is something somebody else can claim
2026-10-14Security
Trusted Publishing was the thing everyone was told to adopt because it removes long-lived tokens. It verified publishers by GitHub repository name rather than by the repository's permanent id, so a renamed or deleted repo could be taken over and used to publish to an existing package.