incorrect "verified provenance" badge shown in `package/{package}/versions`

[sapphi-red]

Describe the bug

@bitwarden/cli v2026.4.0 does not have a provenance on https://npmx.dev/package/@bitwarden/cli/v/2026.4.0 or https://www.npmjs.com/package/@bitwarden/cli/v/2026.4.0?activeTab=versions. But the badge is shown in https://npmx.dev/package/@bitwarden/cli/versions

Additional context

No response

Logs

[MatteoGabriele]

Weird enough, I actually cannot see 2026.4.0.
Could have been a hiccup?

[sapphi-red]

2026.4.0 was a version that was compromised so it was probably removed by npm.

[MatteoGabriele]

I wonder, though, what the shape of the response was in that case.

[MatteoGabriele]

Should we consider removing it once it's deprecated? Compromised packages might be in a weird state.

[sapphi-red]

Unfortunately I didn't save the response.

I think it shouldn't be removed even if it's deprecated. A version can be deprecated for other reasons.