Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem

A malicious package with valid SLSA provenance was released in the Red Hat npm namespace, highlighting the risk of deepfake attacks on the software supply chain. This demonstrates that even trusted sources can be compromised. Developers should remain vigilant and not solely rely on package signing and provenance. Regularly scan and verify packages before use.