NPM flaw allowed 'an attacker to publish new versions of any NPM package' (theregister.com)