Supply-chain attack on VaultBridge SDK exposes 1.2M enterprise tokens

A poisoned npm release of @vaultbridge/sdk silently exfiltrated CI/CD secrets for nine days before maintainers noticed. We pieced together the timeline.