{"id":4622,"date":"2026-07-22T09:43:48","date_gmt":"2026-07-22T09:43:48","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/07\/22\/signed-attested-and-malicious-the-software-supply-chain-has-a-deepfake-problem\/"},"modified":"2026-07-22T09:43:48","modified_gmt":"2026-07-22T09:43:48","slug":"signed-attested-and-malicious-the-software-supply-chain-has-a-deepfake-problem","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/07\/22\/signed-attested-and-malicious-the-software-supply-chain-has-a-deepfake-problem\/","title":{"rendered":"Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem"},"content":{"rendered":"
\"software\"<\/div>\n

\"software\"<\/p>\n

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then\u2026it contains malware.<\/p>\n

That is no longer hypothetical. When the Miasma worm tore through the @redhat-cloud-services npm namespace in June, its malicious releases carried real SLSA provenance, because they were built in Red Hat\u2019s own GitHub Actions workflows and published with legitimate OIDC tokens minted for those runs. To a registry scanner, the poisoned versions were indistinguishable from a routine update.<\/p>\n

The closest analogy is a deepfake. On a video call, a synthetic face can pass at first glance, and you only catch it when something underneath gives it away. Software supply chain attacks have reached the same point, with one difference that makes them worse: A deepfake at least gives you something to catch. Miasma\u2019s packages offered nothing at the level scanners look. The provenance was genuine; every signal a scanner checked was real, just worn by the wrong people. When attackers can put on the trust signals themselves, verification of those signals stops being a defence.<\/p>\n

From Forging Signals to Wearing Them<\/h3>\n

For years, software security rested on one assumption: That signing, verified maintainers, provenance, and attestation were hard to fake. To the average eye, a package called \u201crequets\u201d looks like \u201crequests\u201d \u2013 but a careful eye, or a decent scanner, could spot the seam. The attackers learnt to stop trying, so they started going upstream of it \u2013 compromising the accounts and pipelines that issue those signals.<\/p>\n

The pattern is now well documented. Shai-Hulud, the first self-propagating npm worm, surfaced in September 2025, stealing maintainer tokens to republish poisoned packages. By late November, its second wave, \u201cThe Second Coming,\u201d had backdoored 796 npm packages totalling more than 20 million weekly downloads.<\/p>\n

In 2026, the payload was open-sourced as Mini Shai-Hulud. Attackers hijacked TanStack\u2019s release pipeline mid-workflow, and its own trusted identity published malicious packages carrying valid SLSA provenance \u2013 it was the first time a poisoned package had shipped with genuine attestation. Days later, the worm swept more than 300 malicious versions across AntV packages in under half an hour, now minting real attestations for every package it spread to. Then came Miasma, where attackers published from inside Red Hat\u2019s own pipeline, and the trust machinery did the rest. Within days, the same worm had moved into 73 Microsoft GitHub repositories, planting files that executed the moment a developer opened the code.<\/p>\n

Inheriting the Trust Stack<\/h3>\n

A single stolen login now carries the full weight of the trust stack behind it. Miasma began with one compromised employee\u2019s GitHub account, and researchers traced the Mastra compromise to a stale contributor credential that still held publish access to all 144 packages in the namespace. In Miasma\u2019s case, the system then did exactly what it was built to do \u2013 it signed and attested the malware.<\/p>\n

The parallel with deepfakes<\/a> holds in two specific ways. First, there\u2019s no fixed signature to catch: the worm writes a uniquely encrypted payload for every infection, so hash-based indicators are useful for one copy. Second, it strikes when a developer\u2019s guard is down. The dropper fires when an infected repository is opened in Claude Code, Gemini CLI, VS Code, or Cursor, and a later variant goes further, planting a plain English instruction file that tells the AI agent to run the payload as a routine setup.<\/p>\n

And for developers, the uncomfortable part is that nothing is technically broken. Provenance and attestation were built to answer one question: Did this come from where it says it did?<\/p>\n

These attacks live entirely inside the \u201cyes.\u201d SLSA\u2019s own threat model puts \u201csoftware producer intentionally submits bad code\u201d explicitly out of scope \u2013 trust of the producer, it notes, is a separate property from integrity. SLSA\u2019s maintainers made the same point in their own Mini Shai-Hulud post-mortem: SLSA records evidence, but policy decides what\u2019s acceptable. Provenance tells you how something was built, not whether it\u2019s safe to run. There\u2019s no bug here to patch, because nothing failed on a technical level.<\/p>\n

What Actually Has to Change<\/h3>\n

The fixes sit in the pipeline between the registry and the build, and they run on behaviour rather than paperwork. Watch what a package does \u2013 install hooks, network calls, what changed between versions \u2013 and watch the account behind it: One person does not legitimately publish 144 packages in 88 minutes. Treat brand-new versions as unproven until they\u2019ve aged because malicious releases are typically caught within hours, so even a short holding window strips out most of them before they ever reach a build. And catch it at ingestion. By the time an advisory lands, anyone who installed a package inside the exposure window is already compromised.<\/p>\n

It\u2019s also worth being honest about the limits. Enforcing provenance verification would have stopped Mastra, whose organisation generated attestations but never required them, so the registry accepted updates that quietly dropped the signature. It would not have stopped Miasma, whose provenance was entirely real. Signature checks are necessary but no longer sufficient on their own. You catch a deepfake by watching what\u2019s underneath the face \u2013 the expression that doesn\u2019t fit, or the delays that follow. Software needs the same instinct: A control point between the open registry and the developer\u2019s machine. Hold a package there, examine what it does before it touches a build, and make policy-as-code and continuous scanning the default posture rather than the retrofit. The problem this industry has to solve now is that the signatures will keep checking out.<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

A developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then\u2026it […]<\/p>\n","protected":false},"author":1,"featured_media":4623,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4622","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4622"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4622\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4623"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4622"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}