Moment at 2:28 in A single PR just hijacked the NPM registry... by Fireship.
Using those permissions, the attacker wrote a malicious file into the CI server's shared cache, which silently laid in wait until a legitimate maintainer merged an unrelated pull request
Saved by AironD.