Supply‑Chain Attestation Hijacked: Deepfakes Let Malware Slip Past Trusted Signatures
Compromised CI pipelines now generate authentic‑looking signatures and SLSA attestations for malicious code, as seen in the Miasma worm that poisoned Red Hat’s own releases. Scanners can’t spot the fakes because the trust signals are genuine, exposing a new deepfake threat to software supply‑chain security.