Registry package trust after source divergence

On September 6, 2026, the Roundtable received reports that ChainDrop altered 444 npm packages across 2,212 versions in under four hours by republishing tarballs without matching GitHub commits.

Although those figures and mechanics remain unverified, the reported mutation path creates an immediate operational problem: repository review alone cannot establish registry-artifact trust.

Execution evidence therefore needs to drive containment now, while authoritative affected-version data is still missing.

Affected populations are: npm consumers whose lockfiles or caches contain a package version later confirmed as affected, for whom presence establishes exposure; CI operators and developers whose runners or workstations executed such a package, for whom execution triggers containment; release teams and downstream consumers handling artifacts produced after execution, because those artifacts require quarantine; owners of credentials accessible to the executed process, because those credentials enter the default rotation scope; and reviewers relying on clean GitHub history or code review, because those checks cannot clear a divergent npm registry tarball. No specific package names or versions can be enumerated from this packet.

1. The supply-chain analyst's September 6, 2026 analysis supports tarball-level verification: it reports that stolen npm tokens were used to alter and republish 444 packages across 2,212 versions in under four hours without corresponding GitHub commits. The campaign details remain reported rather than independently verified.
2. The moderator's September 6, 2026 synthesis supports the same trust conclusion: clean GitHub history and code review cannot clear a registry tarball if the reported source divergence occurred. It explicitly treats the figures and mechanics as reported claims.
3. The operational evidence audit supports execution as the containment boundary, quarantine of the execution environment and downstream artifacts, source-bound provenance checks, and rotation of credentials shown to have been accessible.
4. The credential-rotation audit finds insufficient evidence for rotating every reachable credential categorically. It supports default rotation after assessing accessibility while preserving the unresolved exfiltration threshold.
5. The affected-version audit identifies an evidence gap: no authoritative npm package-and-version inventory or registry hashes are available for direct matching.

The supply-chain analyst surfaced the reported ChainDrop mutation path: stolen npm publishing tokens allegedly enabled registry tarballs to change without matching GitHub commits.

The decision scout converted that finding into an execution-based containment rule and initially proposed rotating every reachable credential.

The evidence auditor supported quarantine, downstream-artifact isolation and source-bound provenance checks, but found insufficient evidence for an absolute credential-rotation rule and identified the missing authoritative package-and-version inventory. The boundary reviewer agreed with those limits.

A record search found no prior decision to update, so the arbiter selected a new operational record and changed credential rotation from an absolute rule to the default for credentials shown to have been accessible after execution.