You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
(note: diffing the contents of index.js between Github / NPM package shows no changes, and package.json looks fine too - so it looks like 7.0.3 is a valid release - just surprised by the change back from trusted publishing)
It seems version 7.0.3 failed to publish via GitHub Actions for some reason. Seth might have published it manually, which is why the provenance is missing—it certainly wasn't an intentional change to the workflow.
That said, the package should still install correctly. Are you experiencing any specific issues because of the missing provenance? If it’s causing problems, let me know and I can trigger a 7.0.4 release with provenance included.
No specific issues - just raised my suspicions was all. I manually verified the release contents matched the GitHub repo which satisfied me it was a valid release.
@redonkulus This is probably because you might published 7.0.3 without using GitHub Actions. Please make sure to publish packages via GitHub Actions after the first release with provenance even if the major version of a newly published one is older than that of it. Manually publishing without using GitHub Actions can be confused with the package being compromised by malware.
That said, the package should still install correctly. Are you experiencing any specific issues because of the missing provenance? If it’s causing problems, let me know and I can trigger a 7.0.4 release with provenance included.
Just an FYI, with pnpm's trustPolicy set (the recommended setting), it blocks the install with the error ERR_PNPM_TRUST_DOWNGRADE High-risk trust downgrade for "serialize-javascript@7.0.3" (possible package takeover), so the lack of provenance can potentially affect a large userbase.
Anyway, as a random user, I just wanted to thank you all for this kind of work. Maintainers like you are the real unsung heroes ❤️
Activity
mnahkies commentedon Mar 2, 2026
(note: diffing the contents of index.js between Github / NPM package shows no changes, and package.json looks fine too - so it looks like
7.0.3is a valid release - just surprised by the change back from trusted publishing)okuryu commentedon Mar 2, 2026
It seems version 7.0.3 failed to publish via GitHub Actions for some reason. Seth might have published it manually, which is why the provenance is missing—it certainly wasn't an intentional change to the workflow.
That said, the package should still install correctly. Are you experiencing any specific issues because of the missing provenance? If it’s causing problems, let me know and I can trigger a 7.0.4 release with provenance included.
mnahkies commentedon Mar 2, 2026
No specific issues - just raised my suspicions was all. I manually verified the release contents matched the GitHub repo which satisfied me it was a valid release.
tats-u commentedon Mar 2, 2026
If it is true, it is a wrong idea once you started to add provenances. You need to ship your package via GitHub Actions always to get provenances.
tats-u commentedon Mar 2, 2026
Could you publish 7.0.4 with the same content through GitHub Actions?
okuryu commentedon Mar 2, 2026
published v7.0.4.
tats-u commentedon Mar 2, 2026
I confirm that a provenance has been successfully added.
tats-u commentedon Mar 3, 2026
@redonkulus This is probably because you might published 7.0.3 without using GitHub Actions. Please make sure to publish packages via GitHub Actions after the first release with provenance even if the major version of a newly published one is older than that of it. Manually publishing without using GitHub Actions can be confused with the package being compromised by malware.
https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised
https://socket.dev/blog/rspack-supply-chain-attack
tats-u commentedon Mar 3, 2026
No apology is necessary, just ensure it doesn't happen again.
CleytonGoncalves commentedon Mar 3, 2026
Just an FYI, with pnpm's trustPolicy set (the recommended setting), it blocks the
installwith the errorERR_PNPM_TRUST_DOWNGRADE High-risk trust downgrade for "serialize-javascript@7.0.3" (possible package takeover), so the lack of provenance can potentially affect a large userbase.Anyway, as a random user, I just wanted to thank you all for this kind of work. Maintainers like you are the real unsung heroes ❤️
redonkulus commentedon Mar 3, 2026
Good points, I manually published it instead of using the actions. That was my mistake to get the fix out. I'll be sure to use actions in the future.