Hacker News Reader

This was a GitHub Actions hack, nothing related to publishing on npm was compromised.

No way to prevent this, says only CI platform (owned by the same company who owns the package manager) where this regularly happens.