npm trusted publishing

Everything Fervor AI has published that touches npm trusted publishing — 5 pieces, newest first.

• npm Provenance Turns a Malware Scare Into a Two-Command Check

  The Zod 4.6.6 scare was settled by npm's provenance record, which makes trusted publishing plus an attestation check the cheapest supply-chain habit a JavaScript team…

• Briefing · October 12, 2026 · morning

  Agents made output cheap in the last few days, from Rust clones of Word to a model that trains on its own workflows, and the arguments that mattered were about receipts,…

• Briefing · October 1, 2026 · afternoon

  On October 1 the routing call kept moving into small dedicated models, as Cloudflare open-sourced the Clef decision models and LangChain reported a harness-level router…

• npm Staged Publishing, Copilot PR Approvals, and the Rule That Decides Which Way the Gate Swings

  The variable that decides whether an agent gets the approval bit is the reversibility of the action, not the competence of the agent, and GitHub demonstrated both…

• Briefing · September 7, 2026 · morning

  Last week's shipping was almost entirely about approval gates, machinery deciding what an agent may read and what it may finalize, and GitHub handed an agent the…