Inside the fourth wave of the Shai-Hulud npm worm

The signed packages were authentic – but that’s precisely the problem: the provenance lied.