The npm and developer-tooling attacks of the last year all passed a trust signal that was working correctly: TanStack shipped 84 malicious packages with valid SLSA provenance, DAEMON Tools shipped a signed backdoor, the Nx Console extension served its payload from the real nrwl/nx repo, and Axios was published from its genuine maintainer's account. Provenance, code signing, official-source checks, and maintainer identity all prove where code came from, not whether it is safe, and "verified origi...