From Dev.to
A Verified Build Pipeline Published Malware. Here's What Failed.
The @ethersphere/bee-js 13.3.0 compromise shows why legitimate publishing workflows and valid provenance cannot replace source integrity controls. An automated build pipeline can execute perfectly and...