Why software delivery cannot depend on trust alone

Researchers reported a sophisticated supply-chain compromise of the AsyncAPI project in which attackers injected backdoors into source repositories and leveraged the project's trusted release pipelines to publish malicious npm packages with valid provenance; the payload executed on module import, bypassing common install-time checks and exposing any downstream consumers. The report emphasizes the high blast radius of release-infrastructure compromises, root causes such as overprivileged automation credentials, and the need for pipeline identity governance, human review for untrusted inputs, and binary-level inspection alongside provenance checks.