Bloom Security uncovered a flaw in npm Trusted Publishing that exposed 1,500+ packages to potential malicious takeovers via GitHub.