WS-2026-0129

pnpm 11.0.0-alpha.4 before 11.28.6 and 12.0.0-alpha.2 before 12.12.1: pnpm publish uses the CI-provided NPMIDTOKEN OIDC trusted publishing without checking that the token's aud claim matches the selected registry, so the token is sent to whichever registry the publish targets, including one it wa...