Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.