Sample:
$ guarddog npm scan pi-subagents --version 0.42.1
── Initial execution ──
initial-access-risk: found 1 indicator
│ * threat.metadata.provenance-regression
│ Version 0.42.1 was published without npm provenance attestations, but the earlier version 0.37.1 had them. Losing provenance after previous versions carried it can indicate a publish made outside the normal CI-attested flow, as seen in the nx compromise.
Sounds like the earlier version here should be 0.42.0, not 0.37.1?
Sample:
Sounds like the earlier version here should be 0.42.0, not 0.37.1?