npm worm uses fake provenance attestations to bypass trust checks
Researchers uncovered an npm supply‑chain worm that stole maintainer tokens, injected malicious preinstall hooks, and published infected packages with valid provenance attestations. The fake attestations let the malware slip past automated trust checks, compromising CI pipelines and developer machines. It forces teams to upgrade npm, pin versions, and rethink trusted publishing.