On: 1Password detects "suspicious activity" in its internal Okta account

[smileybarry]

Essentially, yes. And that means duping a developer into adding your code somehow, since builds are digitally signed with a hardware token.

[dzikimarian → smileybarry]

Or supply chain attack

[smileybarry → dzikimarian]

But that requires it to be present before the build is signed, ergo, early in the supply chain. Otherwise, the signature breaks and the build isn’t trusted for the rest of it.