Error in npm audit signatures

[babblebey]

During the implementation of #411, In order to follow established convention in other ESM conversion, I introduced the npm audit signature command into the CI process, but I get below error occurs when it runs in CI, also when it runs in local environment.

audited 807 packages in 150s

705 packages have verified registry signatures

9 packages have verified attestations

102 packages have invalid attestations:

@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@npmcli/[email protected] (https://registry.npmjs.org/)
@octokit/[email protected] (https://registry.npmjs.org/)
@octokit/[email protected] (https://registry.npmjs.org/)
@sec-ant/[email protected] (https://registry.npmjs.org/)
@semantic-release/[email protected] (https://registry.npmjs.org/)
@semantic-release/[email protected] (https://registry.npmjs.org/)
@semantic-release/[email protected] (https://registry.npmjs.org/)
@semantic-release/[email protected] (https://registry.npmjs.org/)
[....minimised]
[email protected] (https://registry.npmjs.org/)
[email protected] (https://registry.npmjs.org/)
[email protected] (https://registry.npmjs.org/)

Someone might have tampered with these packages since they were published on the registry!

Find more details here: https://github.com/semantic-release/exec/actions/runs/11259848667/job/31309764144

[travi]

this is likely because an older npm version is being used in that pipeline. for auditing signatures, the latest npm version is needed. we've added the packageManager property the package.json of others of the repos under this org using corepack: corepack use npm@latest. with that added, we can prepend the audit command as corepack npm audit signatures and it will make sure to leverage the npm version from the packageManager property. renovate will also keep that value from growing stale for us