SLSA Provenance Didn’t Stop the Keyv npm Worm. It Vouched For It.

Every poisoned version of Keyv that went out this week carried a valid SLSA attestation and a legitimate OIDC signature. The build pipeline…