A near-match NuGet package disguised as a trusted .NET dependency, turning supply-chain trust into a narrow, target-specific integrity risk.