Post

If npm tokens are leaked, attackers could locally publish malicious versions without enabling provenance. When you use taze to upgrade deps, it will warn you about any provenance downgrades. The trust levels are: trusted publisher > provenance only > no provenance.