Treat your release pipeline as production, because it can ship an attacker's code under your own name.
The Hacker News reports that attackers used the Ethersphere project's own release automation to publish malicious bee-js 13.3.0 and Swarm Desktop 0.56.2 builds carrying wallet-stealing malware. BigGo Finance reports that Ryohin Keikaku gave up on reopening the MUJI online store after a credential-stuffing attack left traces of unauthorized logins on 270,000 accounts. The Hacker News also reports that some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, found by Picus Security researcher Umut Bayram.
Nothing links these three. One habit still covers a lot of ground: know exactly what can publish a release or sign into an account, and pin your dependency versions instead of trusting a tag to stay the same.
Auditing that path is work we take on, next to payment and account flows, and it runs in days rather than months. Tell us how a release gets built and signed in your setup, and you get cost and timeline back within a day.