As a worm spread through hundreds of npm packages in 2025, it didn't exploit a vulnerability – it exploited the architecture.

Only those collecting fees will be protected until regulators replace risk questionnaires with genuine financial planning ...