npm Ecosystem

The Mini Shai-Hulud worm passed provenance checks by running inside the release pipeline

Akamai says the May 11-12 wave poisoned a CI cache and minted publish credentials from inside a trusted build, so the attestation it produced was honest. Any gate that only checks for provenance would have passed it.