Bloom Security found npm trusted publishing matched GitHub repositories by owner/name until first publish, letting anyone who reclaimed a renamed or deleted slug mint publish tokens for more than 1,500 packages. npm now expires unvalidated configurations after 48 hours.