One thing Npm should implement (at least for popular packages) is deny publishing new versions that don't have provenance [1] if the previous versions had it. T

One thing Npm should implement (at least for popular packages) is deny publishing new versions that don't have provenance [1] if the previous versions had it. This would have stopped this attack. [1] https://docs.npmjs.com/generating-provenance-statements https://docs.npmjs.com/generating-provenance-statements