When One Transitive Dependency Shakes the Whole ISV Market: Lessons from Shai-Hulud
One compromised maintainer, 444+ packages, ~2B monthly installs. What the Shai-Hulud npm worm teaches platform teams about install-time trust — and how to harden against the next one.