npm’s Quiet Weak Point: When Maintainer Access and Build Hooks Turn a Package into Payload

A fast-moving package compromise shows how registry identity, lifecycle scripts, and native build files can turn dependency install into an execution path.