npm Can't Fix This From the Outside

Last week npm shipped 2FA-gated publishing. Eight months too late, two years behind PyPI. The pattern is structural: npm always patches last because the registry is closed source. The fix is three tiers, automated scanning, and opening the source.