Unauthorised release published from a compromised account

A release was published from a maintainer account without a second factor. The added post-install step read environment variables and posted them to a remote collector. The release was pulled, but any lockfile written while it was live still resolves to it.

SyntheticThis advisory is invented for the demonstration. color-name is a real package; nothing described here has been reported against it.