Tag: AntV packages
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
