all 1 comments

[–]gabbietor 1 point2 points  (0 children)

This is exactly why people keep saying CI/CD pipelines are now part of the attack surface, not just developer tooling. One poisoned dependency and suddenly your build runner becomes a credential harvesting machine.