14:35
2026-06-18
dev.to
developer-tools
One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.
The npm account 'ai' publishes seven packages that collectively receive 964 million weekly downloads, yet none have npm provenance attestations. This single-publisher, no-provenance pattern mirrors re…