Vulnerability in the NPM repository allowing the addition of a maintainer without confirmation
A security issue has been identified in the NPM package repository that allows a package owner to add any user as a maintainer without the user's consent and without informing them of the action taken. The problem is exacerbated by the fact that once a third-party user is added as a maintainer, the original package author can remove themselves from the maintainer list, leaving the third-party user as the sole person […]
