npm Trusted Publishing flaw left 1,500 packages open to attackers — Blankdot