There is no Trusted Publishing setup which prevents a compromised repo admin's github PAT from triggering an npm publish, right?
I've spent months trying to find something, but deploy envs w/ required reviews, workflow guards, branch protections, signed tags. All of it can be overwritten w/o 2fa
30 days ago