Most of the time you can just buy an expired domain name tied to a js include or dependency maintainer email address and you now have arguably -legal- ability t

Most of the time you can just buy an expired domain name tied to a js include or dependency maintainer email address and you now have arguably -legal- ability to publish any code you want to thousands of orgs. Plenty of expired npm maintainer email domains right now. Have fun. I have done it twice to bring exposure to the issue. Seemingly no one cares enough to do the most basic things like code signing.