Attackers Abuse GitHub Actions Workflow to Publish Provenance-Signed npm Malware

Attackers have been observed abusing GitHub Actions workflows to distribute provenance-signed malicious npm packages, marking a significant escalation in sof...