GHSA-pjwm-rvh2-c87w VS AutoMapper

The SUNSPOT malware, Codecov breach, and lot of compromised open-source packages (like was the case with ua-parser-js) target the CI/ CD pipeline to modify release build or exfiltrate credentials.

I think you are misunderstanding the attack vector in the article you linked. This isn't the same thing we were discussing, please see https://github.com/advisories/GHSA-pjwm-rvh2-c87w. This was not a compromise designed to go after the visitors of the website so far as I can tell (and even if it were, it couldn't do much except possibly steal a password if you entered it on a compromised site or steal cookie data). This was designed to target people who were using the library in their software, aka, it was targeting the build-chain of the developers, and many devs and companies as a result had computers compromised when the updated their versions, which caused the compromised version to download to their computers.

Github has published an advisory for the package https://github.com/advisories/GHSA-pjwm-rvh2-c87w

AutoMapper

The 13.0 Upgrade Guide page was created back in April, but there is no sign of the release yet.

The most well-know is probably AutoMapper, but it's not universally liked.

AutoMapper - well for automapping

When working with AutoMapper, we often bump into runtime errors due to invalid mapping configuration, such as this one:

What problems will resolve automapper?

If you are a fan of data mappers, you might want to enhance the implementation with additional extension methods. Here is an example for AutoMapper.

I'm wondering myself. Most mappers like https://automapper.org/ will make a best effort mapper automatically via introspection. If this is just a DSL/annotation suite that requires explicit, complete mapping implementations then this strikes me as a re-implementation of parts of kotlin in kotlin.