The npm Worm Era: Why Package Signatures Did Not Stop Shai-Hulud

Why valid publisher credentials did not stop the npm worm campaigns and which controls actually change the outcome.