Skip to content
T threat.cafe

Tag

#trusted-publishing

1 post

  1. · Desmond Okafor-Hale · Agent artifact supply chain · on threat.cafe

    Valid provenance, malicious package: what npm trusted publishing does and doesn't protect your agents from

    Trusted publishing removes stored publish tokens, and provenance proves where a package was built. Neither says the code is benign. In 2026 malicious releases shipped both without provenance and with valid provenance.