npm

OpenAI's macOS Signing Pipeline Got Hit by a 3-Hour npm Compromise

A floating semver tag in CI and a three-hour window on npm were enough for poisoned axios to reach code-signing certificates.