SECRET SCANNING SCANS PUBLIC NPM PACKAGES

Summary from the TLDR Web Dev newsletter

GitHub is now using secret scanning to scan all public packages on npm for leaked secrets. If a potential secret is detected, the service provider that issued the secret will be notified, not the package maintainer.