Commit

PostCSS maintainer Andrey Sitnik adopted npm staged publishing for four of seven packages under the 'ai' npm account, gating 685 million weekly downloads behind human approval. The move, prompted by a…

The npm account 'ai' publishes seven packages that collectively receive 964 million weekly downloads, yet none have npm provenance attestations. This single-publisher, no-provenance pattern mirrors re…