Zetema
Edit
Security & privacy · A few weeksAnywhere· Source · Apr 2026

Yarn users can't block a package update that suddenly arrives without the provenance its earlier versions had.

JavaScript developers who install npm packages with Yarn

Where it stands

  1. Sourced (done)
  2. Kit (done)
  3. Wanted (next)
  4. Building
  5. Solved

How this problem came to be

  1. Found2 sourcesgithub.com/axios, github.com/yarnpkg
  2. Quoted3 claimseach checked against its page
  3. BriefWrittenand what solved looks like
  4. Market2 signals59 reactions on the issue
  5. Kit5 steps21 tools · 6 routes
  6. People0 want0 live it · 0 would test

The problem, broken down

Who it hurts
Developers and CI systems that install npm packages with Yarn.
The moment
When a popular package's maintainer account is taken over and a malicious version is published by hand.
What people do today
People find out from community reports and registry takedowns, hours later.
Why it's unsolved
Yarn has no setting to compare a new version's trust level with earlier ones, and checking provenance for every package adds work to installs.
What solved looks like
A Yarn plugin or patch that, at install time, fails with a clear message when a package that had provenance in earlier versions resolves to a version without it. Tested against a local test registry with a downgrade case and a never-had-provenance case.

Evidence

Every claim is tied to the source it comes from
axios post-mortem: npm supply chain compromise (March 2026) ↗
  1. 1On 31 March 2026 two malicious axios versions were published to npm from a compromised maintainer account and were live for about 3 hours.
Yarn issue #7101: reject packages with a provenance downgrade at install time ↗
  1. 2The Yarn issue says earlier axios releases carried provenance attestations but the malicious ones were published without it, a detectable drop in trust.
  2. 3It asks for an option such as trustPolicy: no-downgrade that refuses a version whose trust level is lower than earlier versions of the same package.

Written from the cited sources. Anything they don't say is left as a question, not a guess.

Sources

From a public page with a citation.

  1. [1]axios post-mortem: npm supply chain compromise (March 2026)
  2. [2]Yarn issue #7101: reject packages with a provenance downgrade at install time
What the source says, in short

On 31 March 2026 two malicious axios versions were published to npm from a compromised maintainer account and were live for about 3 hours. The Yarn issue says earlier axios releases carried provenance attestations but the malicious ones were published without it, a detectable drop in trust. It asks for an option such as trustPolicy: no-downgrade that refuses a version whose trust level is lower than earlier versions of the same package.

Forks 0

Nobody has forked this yet. Be the first.

Market read

How big this is, from the evidence

  • GitHub ↗Builders' pull · Medium confidence59 reactions on the issue
  • GitHub ↗Builders' pull · Medium confidence907 reactions on the issue

How these were measured: Total reactions on the GitHub issue, read from its API.

For whoever takes this up

The builder's path for this problem

Five steps, each with the tools that fit this problem and a word to carry with you. A starter prompt is ready to paste into any assistant.

Open the path

Discussion 0

No comments yet.