Developers often assume that packages published through official channels have passed through a secure release process. That assumption is fundamental to modern software development, where open source ...