A credential-stealing worm in a major vendor’s npm namespace. The namespace is the trust signal, and it delivered the reviewer’s assumption too.
Enhanced verification for everyone is just verification. An alert triggered by a population is not a signal.
Two incidents among four operators is a strong signal. Two among several thousand is close to nothing.
Payments become known; refusals do not. The observable signal is biased towards paying, and it is the observable signal that sets expectations.
A three-day e-commerce shutdown was a decision, not a failure. The delayed earnings release is the mandatory signal breach law never produces.
1,900 is the exposure. Three is the objective. No notification scheme has a field for that.