Signed, Sealed, Compromised: Why Trusted Packages Are Now a Ransomware Delivery Vector

This report warns that software supply chain attacks—notably self-propagating package worms in ecosystems like npm and PyPI—can bypass provenance and signing because malicious code executes at install time within privileged CI/CD and developer environments; it argues for a prevention-first runtime control (Automated Moving Target Defense) that blocks hostile in-memory execution regardless of a package's signature.