// #package-signing

Lockfiles Don't Protect You When the Maintainer Is the Threat

Three npm supply chain attacks in a single week — Axios, @bitwarden/cli, and CanisterSprawl — have been met with the same industry response: update your lockfile. This is wrong. When the original maintainer account is compromised, a new legitimate-signed version is published, and lockfiles pin to whatever is current, the entire model breaks down. The industry is treating a trust infrastructure failure as a dependency hygiene problem.