Definition
Trusted provenance refers to attestations (often SLSA) that an npm package was built/published via a verified CI identity (e.g. github Actions OIDC). It proves build origin — not package safety.
Key Points
- Attackers with maintainer GitHub access can publish malicious packages that still carry valid provenance signatures
- shai-hulud-worm Aug 4 2026 keyv wave and June miasma-worm both abused this trust illusion
- Defenders must not equate “provenance verified” with “malware-free”
- Complements (does not replace) lockfile pinning,
--ignore-scripts, and credential hygiene