Credential Half-Life Scorecard

A worm stole your npm token twenty minutes ago. It is already publishing. Nothing here asks whether you would have caught it — in the August 2026 keyv compromise the malicious packages were correctly signed and passed provenance checks, so detection was not the deciding factor. What decided each victim's blast radius was how long a stolen credential stayed useful. Eight questions, and every one assumes the token is already gone.

Written after the keyv and cacheable compromise — where valid signatures and passing provenance stopped nothing, and credential lifetime decided everything.