AppSec review: npm remote/virtual format (S15)

🎯 Why

Staged AppSec review of the npm remote/virtual format (S15), per gitlab-org&22668. Starts when the format is dev-complete. If this is the first remote/virtual format to complete, the review includes the S13 virtual & remote foundation.

🧭 Scope

• Remote upstream credential handling (encrypted columns, all-or-none constraints)
• Server-side fetches to configured upstreams (SSRF surface, redirect handling)
• Cache write/read paths (poisoning, negative-cache behavior)
• npm-specific: packument merging across upstreams (JSON parsing of remote content, tarball URL rewriting)

Thinnest existing threat-model coverage; may extend the threat model.