Latest releases seem to have lost attestation/trusted publisher status?

The report concerns npm trusted-publisher provenance for the @github/copilot-sdk-darwin-arm64 package: version 1.0.13 was published from github-actions, while 1.0.26 came from copilot-cli-release-app. Start by comparing the publish workflows and the npm trusted-publisher settings for both identities, which the payload does not include. Done means the maintainers confirm whether the 1.0.26 release is expected and either restore provenance or document the change.

I'm using mise to install @github/copilot-language-server and it uses aube to install npm based toolchains. aube has a trust policy concept, and in mise it's default is trustPolicy=no-downgrade https://aube.sh/security#trust-policy which basically requires that if a release was previously published with attestation and a newer release is missing it. This is to prevent supply chain attacks where for example, an attacker gains API access to publishing new packages, but doesn't have the signing keys or only got a developer credential rather than the CI's publishing credentials. In that case, the newer release published by an attacker would be missing the attestation it normally has, and aube would catch that as a potential attack.

From my mise error (detailed below), I think the gist is that @github/copilot-sdk-darwin-arm6 (and probably the other platforms) were previously published to npm with a trusted publisher, but are not published via the trusted publisher anymore, so it fails aube's checks.

I'm not sure what the cause is, but I noticed at some point the releases were publishing under github-actions in eg: https://github.com/github/copilot-sdk/releases/tag/v1.0.13 but now they're published under copilot-cli-release-app: https://github.com/github/copilot-sdk/releases/tag/v1.0.26. Perhaps that's the cause? https://docs.npmjs.com/trusted-publishers makes me think that perhaps this new identity doing publishing in GitHub is also the identity publishing to npm, but it might not be configured correctly in npm, or maybe there was another switch that caused isses.

Error logs

My mise config contains the following:

[tools]
"npm:@github/copilot-language-server" = "latest"

And I've previously installed the package, so my lockfile has details about a previous release indicating it had attestation.

Here's the full error what I'm seeing in mise:

npm:@github/copilot-language-server@latest: aube install failed: failed to resolve dependencies
  caused by: trust downgrade for @github/[email protected] (trustPolicy=no-downgrade): earlier published version 1.0.13 had trusted publisher but this version has no trust evidence

This is a supply-chain trust failure, not an ordinary version-resolution error. An earlier release had stronger trust evidence than the selected release. This can indicate a compromised or tampered release; it can also happen when a maintainer manually publishes, backports outside the trusted workflow, skips provenance for convenience, or uses a registry that strips metadata.

Before bypassing, inspect the package's npm release, source tag/commit, publisher identity, and tarball; compare the metadata with npmjs.org. Confirm the release is expected and nothing appears tampered with, then report inconsistent evidence to the relevant upstream owner. Package-release drift belongs with the maintainer; metadata present on npmjs.org but missing from a proxy or mirror belongs with that registry operator.

Only after review, add the narrowest affected `<package>@<version>` to `trust_policy_excludes` for this tool, e.g.:
  "npm:@github/copilot-language-server" = { version = "latest", trust_policy_excludes = ["<package>@<version>"] }
A bare package name exempts every version. `mise settings npm.shell_out=true` uses the npm CLI and bypasses this check entirely, so it should be a last resort.

Investigation guide and known exceptions: https://aube.jdx.dev/security#trust-policy

npm:@github/copilot-language-server@latest: aube install failed: failed to resolve dependencies
  caused by: trust downgrade for @github/[email protected] (trustPolicy=no-downgrade): earlier published version 1.0.13 had trusted publisher but this version has no trust evidence

This is a supply-chain trust failure, not an ordinary version-resolution error. An earlier release had stronger trust evidence than the selected release. This can indicate a compromised or tampered release; it can also happen when a maintainer manually publishes, backports outside the trusted workflow, skips provenance for convenience, or uses a registry that strips metadata.

Before bypassing, inspect the package's npm release, source tag/commit, publisher identity, and tarball; compare the metadata with npmjs.org. Confirm the release is expected and nothing appears tampered with, then report inconsistent evidence to the relevant upstream owner. Package-release drift belongs with the maintainer; metadata present on npmjs.org but missing from a proxy or mirror belongs with that registry operator.

Only after review, add the narrowest affected `<package>@<version>` to `trust_policy_excludes` for this tool, e.g.:
  "npm:@github/copilot-language-server" = { version = "latest", trust_policy_excludes = ["<package>@<version>"] }
A bare package name exempts every version. `mise settings npm.shell_out=true` uses the npm CLI and bypasses this check entirely, so it should be a last resort.

Investigation guide and known exceptions: https://aube.jdx.dev/security#trust-policy
lockfile generation would downgrade recorded provenance; previous files were preserved
aube install failed: failed to resolve dependencies
  caused by: trust downgrade for @github/[email protected] (trustPolicy=no-downgrade): earlier published version 1.0.13 had trusted publisher but this version has no trust evidence

This is a supply-chain trust failure, not an ordinary version-resolution error. An earlier release had stronger trust evidence than the selected release. This can indicate a compromised or tampered release; it can also happen when a maintainer manually publishes, backports outside the trusted workflow, skips provenance for convenience, or uses a registry that strips metadata.

Before bypassing, inspect the package's npm release, source tag/commit, publisher identity, and tarball; compare the metadata with npmjs.org. Confirm the release is expected and nothing appears tampered with, then report inconsistent evidence to the relevant upstream owner. Package-release drift belongs with the maintainer; metadata present on npmjs.org but missing from a proxy or mirror belongs with that registry operator.

Only after review, add the narrowest affected `<package>@<version>` to `trust_policy_excludes` for this tool, e.g.:
  "npm:@github/copilot-language-server" = { version = "latest", trust_policy_excludes = ["<package>@<version>"] }
A bare package name exempts every version. `mise settings npm.shell_out=true` uses the npm CLI and bypasses this check entirely, so it should be a last resort.

Investigation guide and known exceptions: https://aube.jdx.dev/security#trust-policy