Topic starter
02/08/2026 12:07 pm
TL;DR: NPM provenance is designed to cryptographically link a published package to a specific source commit and build pipeline, but adoption is still limited, with only 26 of 205 highly downloaded jsDelivr packages using it in the article’s sample, according to Exaforce. Without registry and client-side enforcement, package trust remains a supply chain problem, not a solved control.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “Npm provenance: bridging the missing security layer in JavaScript libraries”.
By the numbers:
- Among the 2,000 most downloaded packages on jsDelivr, 205 packages have a public GitHub repository and directly publish to npm using GitHub Workflows.
- Only 26 packages have enabled provenance, which equals 12.6% of that 205-package sample.
Key questions
Q: What breaks when provenance attestation is not enforced for npm releases?
A: The organisation loses cryptographic proof that a package came from an approved build process.
Q: Why does compromised CI/CD identity undermine package provenance?
A: Provenance depends on the integrity of the account and runner that produce the build attestation.
Q: What are the signs that package trust controls are too weak?
A: Warning signs include broad use of latest tags, missing provenance requirements, direct CDN loading without integrity checks, and no policy for critical dependency approval.
Practitioner guidance
- Enforce provenance on critical dependencies Require cryptographic provenance for packages that ship into production applications, and block promotion when attestation is missing or invalid.
- Harden publishing identities and CI/CD paths Protect repository accounts, runner identities, and publishing credentials with strong access controls, audit logging, and periodic review.
- Verify package provenance before dependency approval Add provenance checks to dependency intake so maintainers and build systems cannot introduce unauthenticated packages unnoticed.
Bottom line: NPM provenance can cryptographically tie a package to its source and build path, but the article shows that optional use leaves trust too weak to stop supply chain abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:11 pm
NPM provenance is only meaningful when it becomes an enforced control, not an optional signal. The article makes clear that cryptographic attestation can still exist inside an ecosystem that accepts unsigned or unverified packages. That means the real governance issue is whether registry and client tooling require the proof before trust is granted. Practitioners should treat provenance as an admission control problem, not a documentation problem.
A question worth separating out:
Q: Should teams use provenance or Subresource Integrity first?
A: They solve different parts of the problem, so the right answer is to use both where applicable. Provenance governs how a package was built and published, while Subresource Integrity governs what the browser executes when code is loaded from a CDN. Teams should prioritise the control that matches the delivery path they actually use.
👉 Read our full editorial: NPM provenance gaps leave JavaScript supply chains exposed