SlugFest: The npm Trusted Publishing flaw that trusted names, not IDs

npm keyed publishing trust on a renameable owner/repo name instead of GitHub's immutable repository ID, exposing 1,500+ packages. The bug, the fix, and the same mistake in your own authorization code.