[squidsoup]

This was a GitHub Actions hack, nothing related to publishing on npm was compromised.

[rdg1991]

No way to prevent this, says only CI platform (owned by the same company who owns the package manager) where this regularly happens.