WhatBrokeToday
Today's Trends
minorInvestigatingnpmv7.10.x

Prisma CLI 7.10.x Missing Provenance

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

The prisma CLI version 7.10.0 and 7.10.1 are published without npm provenance, which is a security concern as previous versions had provenance attestation. This issue affects all users who have installed these versions.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Technical root cause

Missing npm provenance for the latest 7.x releases of prisma CLI

Evidence

1 report · 1 GitHubShow
  1. [1]
    GitHub First report
    prisma CLI 7.10.x is published without npm provenance(opens GitHub issue in a new tab)

    Package and version prisma 7.10.0 and 7.10.1 (CLI). 7.10.1 is the latest 7.x. What happened? Since #30035, the prisma package is published with PRISMABOT_NPM_TOKEN instead of OIDC trusted publishing, and 7.10.0 and 7.10.1 ship without a provenance attestation. Every earlier 7.x release had one, and the other @prisma/* packages from the same release still do. | Version | Published by | Provenance | |---|---|---| | 7.9.1 | GitHub Actions | yes | | 7.10.0 | prismabot | no | | 7.10.1 | prismabot |…

    by bytaesu 5upvotes 4comments

Timeline

  1. First report on GitHub issue

    prisma CLI 7.10.x is published without npm provenance

    Source