Provenance proves where and how a package was built: which source, which builder, and when. It does not prove the code is free of malicious behavior. Treat it as evidence that narrows the questions you must ask, not as a safety certificate.
Definition
Build provenance is signed metadata describing how an artifact was produced. In npm, publish attestations are generated when an authorized user publishes, signed with Sigstore and recorded in a public transparency ledger. The npm docs state that provenance does not guarantee a package has no malicious code, and that it gives you material to audit before deciding to trust it.
What it helps with
- Build compromise and upload threats. The SLSA threat model includes uploading a package that did not come from the expected build, and mitigates it with provenance that names the builder and source. A package with no provenance, or one that does not match the source repository, stands out.
- Traceability. You can map a version to a commit and a build run, which speeds triage after a report.
- Policy. You can require provenance for critical dependencies.
What it does not help with
| Question | Answered by provenance? |
|---|---|
| Was this built from the repository it claims? | Yes, if verified |
| Did a trusted maintainer write the code? | No |
| Is the code benign? | No |
| Is the dependency vulnerable? | No, that needs advisory data |
| Is the name a typosquat? | No, SLSA calls typosquatting mostly outside its scope |
How to use it
- Decide where it matters. Start with the few dependencies that run in production with broad privileges.
- Verify, do not just display. A badge on a page is not a check. Use tooling that validates the attestation against the expected source.
- Compare to expectations. Match the repository, workflow and branch to what you know about the project.
- Handle absence. Many packages publish no provenance. Decide whether lack of it blocks adoption, raises review, or is accepted.
- Combine it. Pair provenance with monitoring and a version delay.
Questions for suppliers
If a vendor claims provenance, ask what framework level they target, how a customer verifies it, and whether it covers every release or only some. Ask what is in scope, as with any claim.
Quick check
Does provenance stop a hijacked maintainer?
Not by itself. If the attacker publishes through the legitimate workflow, provenance can look normal.
Is provenance the same as a signature on a binary?
No. A signature shows who signed. Provenance describes how the artifact was built.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning and policies you can apply to what enters a build. Provenance verification is a practice you adopt alongside it. A free scan gives you the inventory to decide where to start.
Sources
Last reviewed: 19 October 2026.
