Valid provenance on a malicious release
The compromised packages were published by the real pipeline, from the real repository, with build provenance that verified. Nothing was forged and nothing was bypassed.
The attacker did not defeat the provenance. They got their code into the build, and the build attested — accurately — to what it had just built.
Six beliefs about this pipeline are written on the board. Two of them the provenance actually supports.
Boundaries, outermost first: What the team believes: We are level three (so we are covered), It names the builder (and the source revision), Safe to install (everything verified), Nothing was swapped (after the build ran), The build is hermetic (sealed off from the net), The source was reviewed (before it was built) Outside every boundary: Source (the real repository), Registry (published normally), Consumers (every check green), Provenance (signed, and accurate), Hosted builder (the real pipeline; FAILED: their code ran here) Connections: Source calls Hosted builder (step 1) Hosted builder controls Provenance — describes the build (step 2) Provenance calls Registry (step 3) Registry calls Consumers — verifies fine (step 4)