Leaked npm access token — supply-chain attack risk

An npm token grants publish access to every package the owner can publish. Leakage of a publisher's token is the classic supply-chain attack vector — the attacker publishes a malicious version of a popular package.