Why recent Vercel CLI releases have no npm provenance

Development and npm publishing for the Vercel CLI now happen from a private repository. The public vercel/vercel repo remains the source-available mirror and will continue to receive synced updates.

Releases from 58.5.1 onward are official Vercel publishes. They are still released through npm Trusted Publishing. What you will not see on those versions is npm provenance attestations: npm does not support provenance when the publish source repository is private (docs). That absence is expected with this setup and is not a sign of a compromised package.

How to verify a release

For [email protected] and later, compare the integrity we host to npm's:

# hosted by Vercel
curl -sS https://vercel.com/docs/cli/release-notes/npm/58.8.0/integrity

# from the npm registry
npm view [email protected] dist.integrity