Execution moved from install to import. The flag everyone added after the last campaign is still set, and no longer covers anything.
A credential-stealing worm in a major vendor’s npm namespace. The namespace is the trust signal, and it delivered the reviewer’s assumption too.
The most heavily governed system in the organisation, with a dependency path that has no governance attached to it.
Nobody assessing a phone-system vendor thinks to ask about its staff’s trading software.
Code signing answers "did this come from the vendor". Here the answer was yes, and it was the wrong question.