Auditing the npm Trust Chain After ChainDrop: Tokens, OIDC, and Postinstall
ChainDrop put valid provenance on more than 400 npm packages, and every one of them still carried hostile code. That isn't a Sigstore bug or an npm bug. It's a misread signal. This audit walks the trust chain a publish actually travels. What an attestation really asserts — builder identity, source repository, commit SHA, workflow ref, and a Rekor log index — and what it structurally cannot assert: whether the code is benign, whether a human looked at it, whether anything scanned it. Two rows of that table are provable from the format alone; the incident specifics the report doesn't publish stay marked unknown. Then the commands, so you can check each link yourself: npm view for dist.attestations, npm audit signatures for the split between registry signatures and attestations, the Sigstore bundle for the in-toto subject digest, and the jq field that matters in an incident review — the workflow ref. If a package's history comes from release.yml on main and the bad version comes from a lint-fix branch, that's the door. Same for a tarball digest that diverges from your lockfile integrity hash: stop there. The last section covers the case tooling won't flag, because there is nothing to flag: a truthful attestation over a workflow the attacker controls. Full write-up: https://hackyjs.com/posts/auditing-the-npm-trust-chain-after-chaindrop-tokens-oidc-and-postinstall