npm provenance signed the malware on 4 August 2026: what attestations prove and what a cooldown stops

npm provenance signed the malware on 4 August 2026: what attestations prove and what a cooldown stops Summary. On 4 August 2026 at 09:35 UTC, keyv@6.0.0 was published to npm with a preinstall hook, an