A signed npm package can still be a trap if the CI/CD pipeline or maintainer account is compromised. The break is not just a bad dependency; the trusted publishing path itself can be used to ship poison that still looks legitimate to verification tools.
Microsoft says 32 @redhat-cloud-services packages were altered across more than 90 versions after attackers used the RedHatInsights/javascript-clients CI/CD pipeline and a legitimate GitHub Actions OIDC publishing workflow. The packages kept authentic provenance signatures, then ran a preinstall hook that stole credentials from developer and CI systems and helped republish more poisoned versions.
That leaves a clean-looking artifact as a live infection point and a persistence channel. Teams that rely on package signatures alone still need to treat the publishing workflow as part of the trust boundary.