Post

trusted publishing is fantastic for ensuring that the state of a @github.com repo maps to a public package ... but maintainers are still vulnerable to phishing, allowing bypassing it so: this action fails ci when upgrading to a 'non-provenanced' package

daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance. 📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1) 🎨 inline GitHub annotations ✅ JSON output + configurable 💪 published in TS with zero deps

github.comGitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

16/9/25, 12:25 pm3 reposts28 likes

daniel r(ooooooh) at jsconf mx 🇲🇽

@danielroe.dev

16 Sept 2025

it also fails CI when downgrading from trusted publishing to ‘normal’ provenance plus you can configure it to fail CI if trusted publishing repo, branch or workflow name change, thanks to a suggestion from @dominikg.dev! (it’s more strict though there may be false positives)

Wes

@notwes.bsky.social

16 Sept 2025

Please push folks to setup forced 2FA. That was the main weak link this week.

Wes

@notwes.bsky.social

16 Sept 2025

Also, provenance is not even a good indicator of what you say. Reproducibility would be.

Wes

@notwes.bsky.social

16 Sept 2025

blog.vlt.sh/blog/reprodu...

blog.vlt.shReproducibility vs. Provenance: Trusting the JavaScript Supply ChainWe launched a new tool to detect package integrity issues in the JavaScript ecosystem. Learn how `reproduce` is changing the game.

Wes

@notwes.bsky.social

16 Sept 2025

The problem is you can fall for many other types of attacks and still be marked as trusted. @github.com really dropped the ball here and I am frankly getting annoyed with having to point it out so often lately.