npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sweeps the Registry

In response to a sweeping supply chain attack that compromised hundreds of npm packages, npm has invalidated all granular access tokens bypassing 2FA and introduced staged publishing to require human approval before releases go live, but fundamental risks in CI/CD workflows and trusted publishing remain unresolved.