The release that never touched CI
The repository is protected, reviews are required, and the pipeline runs tests before every release. A maintainer's personal machine was compromised, and the attacker published a new version straight from it with the maintainer's stored credential.
Every control held. None of them were on the path the release actually took.
Remove the path that bypasses everything else.
Components — tap one, then tap a slot on the diagram
!A release was published from a compromised laptop, bypassing the repository, reviews and CI entirely.
Outside every boundary: Pipeline (tests, scans), Maintainer's laptop (long-lived token; FAILED: compromised), Registry, Repository (reviewed), an empty slot for the who may publish Connections: Repository calls Pipeline (step 1) Pipeline calls who may publish (step 2) who may publish calls Registry — the only way in (step 3) Maintainer's laptop must NOT reach Registry — no longer possible
Pipelinetests, scans
Maintainer's laptoplong-lived tokencompromised
Registry
Repositoryreviewed