Conventional scanners rely on a single rule: find the known flaw, match the CVE, and block the package. Modern supply-chain attacks break that assumption. Today's threats aren't buggy code, they are authorized substitutions. By hijacking maintainer accounts and release pipelines, attackers publish malicious code through trusted paths with valid SLSA provenance and cryptographic signatures. They sail past CVE scanners and SBOMs, detonating install scripts inside your CI runners before an alert ever fires. Anatomy of npm Attacks: Breaking down chalk, Shai-Hulud, and AI tool weaponization (s1ngularity). The Provenance Blindspot: Why SLSA and signatures fail to catch malicious builds. Beyond CVEs: Practical pipeline guardrails to survive day-zero dependency traps. Zero-Execution Defense: Starving npm exploits of a runtime target.