Provenance Record

A genuine cross-case Analysis: Background, Current situation (three fact sections, each source-attributed) and an Implications section explicitly labelled as analysis ('the sources themselves do not make this comparison'). 1,548 words (range 800-2000). It adds a synthesis (each case exploits a binding between a name/account and a trust decision; hash pins held outside the mutable release page worked at OVHcloud; trusted publishing vs the GhostAction secret-theft path) rather than restating the three earlier Herald articles. No prediction, no opinion in the Herald's voice; the Implications claims are each tied to sourced facts stated earlier in the article. Links to the three earlier Herald articles are used for continuity and are not counted as sources.

Read all 7 gzipped snapshots (source-0..6.html.gz), all status 200, no archive fallback, suspicious_patterns null for every source (no scanner hits to override). Then re-fetched all 7 live URLs (all 200) and re-checked the key verbatim strings: all present and matching. source-0 (GitHub changelog 2025-10-28): assets cannot be added/modified/deleted, tags for new immutable releases protected, 'All new releases are immutable', 'Existing releases remain mutable unless you republish them.' (verbatim). source-1 (GitHub changelog 2026-10-02, label 'Retired'): 48-hour expiry, 'Your configuration becomes validated and exempt from expiry after its first successful publish' (verbatim), issue_comment rejection alongside pull_request_target. source-2 (ovh/ovhcloud-cli issue #300): customer CI pins SHA-256 of Linux arm64 archive and failed; 'There was no private vulnerability reporting channel enabled on this repo, hence a public issue' (article paraphrases); maintainer replies and v0.16.0 immutable. source-3 (THN, GhostAction, Oct 9): 817 repos / 327 users / 3,325 secrets, first came to light Sept 2025; 'most likely a leaked personal access token'; workflow names 'Security Audit' / 'GitHub Actions Security', hard-coded IP over plain HTTP; Socket >500 accounts since Oct 7; GitGuardian 772 repos / 373 users Aug 31-Sep 30; StepSecurity 'The absence of abuse so far is not evidence that the credentials are safe.' (verbatim); no malicious package releases at time of writing. source-4 (THN, SlugFest, Oct 13): trusted publishing introduced July 2025, OIDC short-lived token description, binding to 'owner/repository' not permanent ID until first publish, reclaim steps, >1,500 packages / >10 million downloads, reported June 6 2026, Golan Myers quote 'The attack requires no insider knowledge, no credential theft, and no race condition.' (verbatim), and the 'binding between a human-readable identifier and the thing it identifies is the most important invariant in any trust system' quote (verbatim; THN does not name a speaker for this one, the article attributes it to 'the Bloom Security research', a reasonable reading since it opens 'What this research demonstrates', but see concerns). Bloom's four recommended actions match. source-5 (THN, OVHcloud, Oct 20): five releases v0.11.0-v0.15.0, Oct 19, 12:47-14:21 UTC, 'up to 94 minutes' (THN's own figure, matching the earlier reviewed Herald article), checksums.txt replaced on v0.15.0, source/tag/pipeline untouched, release workflow never ran, install script 'has never checked a hash' (verbatim), upgrade command no hash check, Homebrew cask pinned SHA-256, Klaba's second post (quoted by Next) on immutability not activated and now enabled, v0.16.0 immutable with attestation, 'gh release verify-asset', OpenSourceMalware GlassWorm link 'our inference' (verbatim), OVHcloud has not said how credentials were taken, no swapped archive analysed publicly, postmortem promised. Compromise vector is as reported by THN ('used a contributor's GitHub account', 'The account had been hijacked'); the article attributes it to THN and states the method is undisclosed. No individual is named from the OVHcloud case other than Octave Klaba (named in THN for his own public statements); the uploader handle from the issue is not repeated. source-6 (StepSecurity, Oct 9): Oct 8, 345 repos in two windows, Takashi Kitao / pyxel 18,400-star / 27 repos from 13:20 UTC, Henry Wu (henrywoo) / Uber athenadriver / 318 repos 21:10-21:26 UTC, GITHUB_TOKEN scoped contents: read, pyxel dual-published to PyPI and crates.io with publishing secrets templated, 'most plausibly a leaked personal access token', remediation (revoke the compromised GitHub credential, 'Do not cut releases until cleaned', search the workflow filenames). The two named GhostAction individuals appear in both StepSecurity and THN as victim account owners, are not accused of anything, and the article names them only as the sources do. All 10 verbatim quotes checked and verbatim. Allowlist: thehackernews.com, stepsecurity.io, github.com, github.blog and docs.github.com are all present by exact hostname (docs.github.com is not cited here); no allowlist edit. Orphan-link diff: body external URLs == article.sources exactly (0 orphans, 0 unused). Internal links: 3 links of form /article/2026-10/<slug>; all three resolve to existing article files (10-stepsecurity-says-ghostaction..., 20-ovhcloud-cli-releases-hijacked..., 19-bloom-securitys-slugfest...). ANALYSIS REQUIREMENTS: sources 7 (>=4 met). Independent-of-subject count, my own: the writer claims 5; I count 2 independent outlets clearly (The Hacker News, counted once although three articles; StepSecurity, an unaffiliated security vendor which is the original researcher of GhostAction and whose findings THN also relays). Issue #300 is a page in the subject's (OVHcloud's) own repository, so it is not independent as a venue; its reporter is an outside customer whose first-hand observations are independent, but the maintainers' replies in it are first-party, so I count it as at most a partial corroborator and not toward the minimum. The two GitHub changelogs are first-party for the controls under discussion (immutable releases, trusted-publishing expiry) and are not independent. Minimum of 2 independent of the subject is therefore met, but only just and not by 5: it rests on THN and StepSecurity, and for SlugFest and the OVHcloud compromise the third-party reporting is THN relaying researchers (Bloom Security, OpenSourceMalware, OVHcloud/Klaba). Under a reasonable reading (the requirement excludes the vendor's, project's or organisation's own pages; neither THN nor StepSecurity is the subject of any of the three cases) this meets the Analysis requirements; I do not treat it as clearly stronger than that.

Every number, date, time, version, quote and attribution traces to a cited source (see source_verification). Facts agree with the earlier Herald articles on the same incidents (94 minutes as THN's own computed figure; OVHcloud compromise vector as reported by THN; SlugFest 1,500 packages and June 6 report date; GhostAction 345 repositories and the two time windows). Minor points, none correction-level: (1) the closing 'binding between a human-readable identifier...' quote is attributed to the Bloom Security research although THN prints it without naming a speaker; (2) the Implications heading 'Trusted publishing addresses the secret-theft path that GhostAction targets' is framed more broadly than the body supports, because trusted publishing as described removes long-lived npm secrets while the one concrete GhostAction case the article gives (pyxel) held PyPI and crates.io credentials; the body text itself is correctly hedged ('described as removing long-lived npm secrets'). Analysis statements (customer pin and Homebrew pin relying on hashes outside the mutable release page; a checksum fetched from the same place as the archive would not have flagged the change; the entry points differ but each exploits a name-to-trust binding) are logical inferences from sourced facts and are labelled as analysis, not presented as sourced facts.

Approved as an Analysis: it meets the 800-2000 word range, has 7 sources of which 2 independent outlets (THN, StepSecurity) satisfy the minimum on a reasonable reading, examines a cross-case topic rather than recapping one release, and keeps reported facts and labelled analysis separate with no opinion or prediction in the Herald's voice. All facts, numbers, dates and quotes verified against snapshots and a live re-fetch. Featured candidacy: 2 - three October supply-chain cases tied together for a broad developer audience, with sourced practical guidance, but built on thin independent sourcing and not an industry-changing story