Stolen credentials produced valid Sigstore certificates, clearing 633 malicious npm packages — one of seven developer tool ...

It's the "~28% inaccurate" thing that keeps me from using these things for anything other than the occasional novelty. If I can't trust the results and have to check everything for accuracy, I might ...