---
title: "Why “Trusted Publishing” Can’t Save Us from Social Engineering"
url: https://daily.dev/posts/why-trusted-publishing-can-t-save-us-from-social-engineering-1l213gysi
source_url: https://adventures.nodeland.dev/archive/why-trusted-publishing-can-t-save-us
type: article
source: "Adventures in Nodeland"
published: 2026-05-02T15:33:40.592Z
updated: 2026-05-02T15:34:37.869Z
tags: ["security", "npm"]
reading_time: 8
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Why “Trusted Publishing” Can’t Save Us from Social Engineering

**[Adventures in Nodeland](https://daily.dev/sources/nodeland)** · 8 min read · 0 upvotes · 0 comments

## Summary

The Axios npm compromise — caused by a social engineering attack that hijacked a maintainer's live browser session — exposes a critical flaw in npm's 'trusted publishing' model. Provenance attestation via Sigstore/OIDC only verifies who published a package, not whether that person was in control of their machine. The author, who was personally targeted by the same campaign, argues that provenance gives malicious packages a trustworthy signature, making it worse than useless in identity-level compromise scenarios. Proposed mitigations include: configurable release delay windows (minimumReleaseAge, already in npm 11.11.0 and pnpm), anomaly detection for suspicious publish sessions, and dual-control publishing requirements for high-impact packages. The OpenAI certificate rotation incident is cited as a real-world consequence of over-relying on provenance without these additional controls.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://adventures.nodeland.dev/archive/why-trusted-publishing-can-t-save-us>

## Similar posts on daily.dev

- [Axios Maintainer Confirms Social Engineering Attack Behind n...](https://daily.dev/posts/axios-maintainer-confirms-social-engineering-attack-behind-n--gwaje9fz9) · Socket · 4 upvotes · 0 comments
- [Security Lessons For All From GitHub's Hardened Package Publication For npm](https://daily.dev/posts/security-lessons-for-all-from-github-s-hardened-package-publication-for-npm-9t300zqmx) · GitGuardian · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/why-trusted-publishing-can-t-save-us-from-social-engineering-1l213gysi)