The tensorlake detail that deserves more attention: it shipped with valid npm provenance, because the attacker published through the project's own release workflow. Provenance proves the package came from the maintainer's pipeline, not that the pipeline was honest, so the badge can't be treated as a safety signal for exactly the class of attack it was built against. Same shape as advisory scanners reporting green on a vulnerable box: the check inspects one layer while the exposure sits one layer over. Your npmrc grep belongs in CI as a pre-install gate, not just in incident response. One question: in the samples you reviewed, did the payloads actually read MCP config files with API keys in env blocks, or is that row from audit logic rather than observed behavior?