Two npm worms shipped with valid provenance this year
I spent most of this year believing a green provenance check on npm meant something stronger than it does. Two incidents fixed that, and the second one changed what I build. If you haven't used it: when a package is published from a GitHub Actions workflow using an OIDC token, npm records a signed attestation naming the repository, the workflow file, the ref and the commit that produced the…
Two incidents in 2026 revealed that npm packages published from GitHub Actions workflows using OIDC tokens can contain malicious code, even when the package appears to have valid provenance. On May 11, 42 malicious versions were published across 84 @tanstack/* packages, and on August 4, the keyv maintainer's GitHub account was compromised, leading to the spread of the malicious code through cacheable packages in a day.
The malicious code published validly-attested packages by using the project's own release workflow, and the provenance check did not detect the issue, highlighting the limitations of provenance as a trust input. Provenance can still be useful for identifying unexpected changes in the build environment or source commit, but it does not guarantee the integrity of the pipeline.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
