Kevin Deng @sxzz.dev · Aug 21 taze now includes npm provenance downgrade checks to help prevent attacks similar to those previously experienced by Rspack.
14 likes 1 replies
?
Replies
If npm tokens are leaked, attackers could locally publish malicious versions without enabling provenance. When you use taze to upgrade deps, it will warn you about any provenance downgrades. The trust levels are: trusted publisher > provenance only > no provenance.