Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
This is a credential-exposure / credential-confusion issue. getRegistryCredentials() reads credentials from the Docker config file (~/.docker/config.json) and selects an entry by checking whether any configured auth key contains the target registry string: Object.keys(dockerConfig.auths || {}).find((key) => key.includes(registry)) Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for — and transmitted to — a different registry whose hostname has a …