Post

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance. 📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1) 🎨 inline GitHub annotations ✅ JSON output + configurable 💪 published in TS with zero deps

github.comGitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

16/9/25, 12:17 pm31 reposts144 likes

Matteo Gabriele

@matteogabriele.npmx.social

*ahem* now also with Yarn 2+ support 😛

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

16 Sept 2025

❤️🙏

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

16 Sept 2025

ultimately this should probably be implemented by package managers, but until then I hope it's helpful let me know how you find it 🙏 🚧 ... and, as always, it's a work in progress - contributions very gratefully received!

BlustinBlieber

@justatorus.bsky.social

19 Sept 2025

Would you consider reducing the dependencies in Nuxt a priority going forward? Many smaller deps could be vendored or consolidated

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

19 Sept 2025

I would always want to reduce our dependencies!

James

@43081j.com

16 Sept 2025

Awesome work 🥳 Will definitely give it a go This and multiocular by @en.sitnik.ru will help a huge amount in chain security