Signed, Attested, Poisoned — A Self-Spreading Dependency Hunts the Build Pipeline — severe-but-plausible scenario — ITOL

Vector: Cyber · Severity: severe

A maintainer's account is taken. The project's own release workflow ships a poisoned version with valid provenance (the signed record of where a package was built). Within four hours hundreds of packages carry it. Any build that installs it hands over the build runner's secrets: cloud keys, registry tokens, cluster configs, and the developers' AI-agent credentials. The worm commits hooks into the agent and editor configuration on every branch it can reach, under the author name 'claude'. Revoke the stolen token and a dead-man payload fires. No vendor was breached, so no vendor patch is coming.