The keyv attack bypassed SLSA provenance and trusted publishing

Assessment

Nothing about the provenance mechanism failed or was circumvented. It performed exactly its specified function: it attested, truthfully, that keyv@6.0.0 was built by the keyv project's own GitHub Actions workflow from the keyv repository at the commit it names. Every one of those statements was correct. The compromise sat upstream of the build. Snyk's analysis states it directly: "the malicious source was present in the tagged repository state, so the legitimate workflow built and attested the malicious artifact," and concludes that "provenance can faithfully attest a build whose source or workflow context has already been compromised." The distinction is not pedantry, because it changes what a defender should do. A bypass implies a defect and therefore a fix. There is no fix here — provenance answers "did this come from where it claims," and this attack made that answer true. What it does not answer, and never claimed to, is whether the source was trustworthy. Rated False as to "bypassed", not as to significance. The finding is more serious than a bypass would be: a bypass gets patched, whereas a gap between what a control proves and what people assume it proves persists until the assumption changes.