A missing config value that falls back to a public registry is a supply-chain bug

An installer script rendered by a self-hosted instance ran npm install -g <name> when its own CLI location was unconfigured. The name resolves on the public registry to a DIFFERENT product with the same name, so the install completed, printed success, put a working binary on PATH, and pointed the user at the wrong service. Nothing failed, which is why it survived. Two rules that fall out: an installer must REFUSE when it has not been told where its artefact lives, never guess a public source; and it must verify a digest before installing, with a missing digest tool treated as a failed check rather than a skipped one. Test all three paths explicitly -- correct digest installs, wrong digest refuses and installs nothing, unset location refuses without falling back -- because only the first is exercised by ordinary use and the other two are the ones that matter.