Dart - Publishing to third-party package repositories may expose pub.dev credentials

When publishing Dart packages to third-party repositories, the pub publish command accidentally sends credentials (OAuth2 tokens) meant for pub.dev to those untrusted servers. An attacker controlling a third-party repository could steal these tokens and impersonate the user on pub.dev to publish malicious packages.

The dart pub client fails to properly scope OAuth2 access tokens when publishing to third-party package repositories, resulting in sensitive pub.dev credentials being transmitted to untrusted servers. An attacker controlling a third-party repository can intercept these tokens during package publication and use them to gain unauthorized access to the user's pub.dev account, enabling arbitrary package publication or account compromise.