Declarations Are Gameable

The npm supply chain attack that CVE scanners missed — and what it tells us about how trust actually works.