Pick Your Poison: NuGet's Quiet Wrong Versions vs npm's Loud Supply Chain

The premise Some version of this message lands in my DMs about once a fortnight. The package name changes, the exception sometimes changes, the shape doesn't. A green Dependabot PR went in overnight, someone senior approved it, and production now has a stack trace nobody recognises. Monorepos in…