Describe the feature
The version history on npmx doesn't show providence information for versions. This is available on the versions list on npmjs.com so I recently had to keep opening npmjs.org from npmx.dev when I was looking at providence history to check why I was getting some trustPolicy alerts.
vs.
This page also has less providence information than npmx's overview page. The overview's summary has indicators that latest (4.5.4) and canary (4.5.0-canary...) have providence but beta (4.1.13-beta.0), alpha (3.25.68-alpha.11), and next (3.25.0-beta...) do not. But on the version history page the latest/beta/next/alpha/canary tags are displayed without any providence icons on latest/canary. And 4.x (4.5.4) and 3.x (3.26.0-canary.20250708T225111) are displayed without their providence icon next to 2.x (2.0.1-alpha.3) and 1.x (1.11.17).
vs.
The providence information on the summary might also be a bit too simplistic. See uuid compared to (npmjs.com's uuid versions)[https://www.npmjs.com/package/uuid?activeTab=versions] for an example. Providence is displayed on all the tagged versions, that's fine, but it also expands showing versions under that tag. You can't tell the difference between latest where 14.0. and 14.0.1 also have providence like the recent version they are under and legacy-13 where 13.0.0 and 13.0.1 lack providence and it was only added to 13.0.2.
On uuid you could argue this is fine. The fact that trust signals have improved is not a bad thing, so it's just a curiosity. But on vercel if 58.x.x still had a tag it would display 58.11.0 in the summary with no providence tag and when expanded show no providence tags despite the fact that 58.4.4 did have providence. This IS a warning scenario cause on another package this could be an indicator that a developer that opted in to trusted publishing for transparency got replaced or had a token hijacked by someone else who was bypassing the developer's trusted CI system to add something malicious that wasn't in the published source code.
Additional information
Final checks
Describe the feature
The version history on npmx doesn't show providence information for versions. This is available on the versions list on npmjs.com so I recently had to keep opening npmjs.org from npmx.dev when I was looking at providence history to check why I was getting some trustPolicy alerts.
This page also has less providence information than npmx's overview page. The overview's summary has indicators that latest (4.5.4) and canary (4.5.0-canary...) have providence but beta (4.1.13-beta.0), alpha (3.25.68-alpha.11), and next (3.25.0-beta...) do not. But on the version history page the latest/beta/next/alpha/canary tags are displayed without any providence icons on latest/canary. And 4.x (4.5.4) and 3.x (3.26.0-canary.20250708T225111) are displayed without their providence icon next to 2.x (2.0.1-alpha.3) and 1.x (1.11.17).
The providence information on the summary might also be a bit too simplistic. See uuid compared to (npmjs.com's uuid versions)[https://www.npmjs.com/package/uuid?activeTab=versions] for an example. Providence is displayed on all the tagged versions, that's fine, but it also expands showing versions under that tag. You can't tell the difference between latest where 14.0. and 14.0.1 also have providence like the recent version they are under and legacy-13 where 13.0.0 and 13.0.1 lack providence and it was only added to 13.0.2.
On uuid you could argue this is fine. The fact that trust signals have improved is not a bad thing, so it's just a curiosity. But on vercel if 58.x.x still had a tag it would display 58.11.0 in the summary with no providence tag and when expanded show no providence tags despite the fact that 58.4.4 did have providence. This IS a warning scenario cause on another package this could be an indicator that a developer that opted in to trusted publishing for transparency got replaced or had a token hijacked by someone else who was bypassing the developer's trusted CI system to add something malicious that wasn't in the published source code.
Additional information
Final checks