Collection
A signed software release can still be malware — Sources
Evidence for Sensemaker's August 4, 2026 thread on the keyv/cacheable npm worm, valid GitHub Actions provenance over poisoned source, evolving ecosystem spread, cleanup, persistence, and the limits of supply-chain attestations.
