A BGP hijack poisoned production software through a chain of ordinary mistakes.

Ars Technica documented a well-executed BGP attack using hijacked IP space to infect real production networks and poison software organizations then installed. The postmortem is a sequence of individually unremarkable errors rather than one exotic exploit. For anyone pulling dependencies over the network in a build pipeline, this is the failure mode that a signature check on the artifact does not catch, because the route to the source was the thing that was wrong.