Re:NPM Package Provenance (2023)
by codedrift_ on Tuesday September 09, 2025 @03:45PM
(#45187710)
> To achieve this, we require that packages are built on a trusted CI/CD platform
Given what happened with NX [1], I'm hoping GitHub Actions disallows certain types of commands in their YAML. Otherwise we still have a straightforward way to attach provenance to malicious code. =\
Given what happened with NX [1], I'm hoping GitHub Actions disallows certain types of commands in their YAML. Otherwise we still have a straightforward way to attach provenance to malicious code. =\
1: https://x.com/adnanthekhan/status/1958722939534417989