Moment at 1:18 in A single PR just hijacked the NPM registry... by Fireship.
The standard release process uses GitHub to sign a statement that proves a workflow's legitimacy to NPM, generating a short-lived token to publish packages securely without relying on static passwords
Saved by AironD.