npm Supply Chain: The Worm That Walked In Through Trusted Publishing

The unanimous advice since 2025 was to migrate to trusted publishing with OIDC. In May 2026 Shai-Hulud walked in that way and published TanStack packages with legitimate provenance. What OIDC really protects, what it does not, and the four measures that would have stopped the recent attacks.