"Because an npm token was used for version publishing in GitHub Actions, a contributor from another organization had their local machine compromised, which led to the token being leaked. This subsequently affected the echarts-for-react project. Within one hour of the incident, the affected versions were deprecated.
Moving forward, I will use npm tokens more cautiously, and properly manage the scope and permissions of tokens to prevent such incidents from happening again."
因为在 GitHub Action 中使用了 NPM Token 做版本发布，受到其他组织的贡献者本机中毒，到之后 Token 泄漏，进而影响到 echarts-for-react 项目，事发后一小时内就 deprecate 掉受感染的版本，并联系 npm support 完全删除。
接下来，我会更加慎重使用 npm token，以及处理好 token 的使用范围和权限，避免这样的事件再次发生。
"Because an npm token was used for version publishing in GitHub Actions, a contributor from another organization had their local machine compromised, which led to the token being leaked. This subsequently affected the echarts-for-react project. Within one hour of the incident, the affected versions were deprecated.
Moving forward, I will use npm tokens more cautiously, and properly manage the scope and permissions of tokens to prevent such incidents from happening again."
因为在 GitHub Action 中使用了 NPM Token 做版本发布，受到其他组织的贡献者本机中毒，到之后 Token 泄漏，进而影响到 echarts-for-react 项目，事发后一小时内就 deprecate 掉受感染的版本，并联系 npm support 完全删除。
接下来，我会更加慎重使用 npm token，以及处理好 token 的使用范围和权限，避免这样的事件再次发生。