FlagThis

Abstract

Dependency graphs reveal where released code can flow; release-authority records reveal how a release reached users. A package can keep the same downstream exposure while its public authority path changes: a new publisher account, a repository relink, a new workflow, a provenance change, a signing-key movement, or a shift in publication mediation. These transitions expose a release-time review surface over public control-plane evidence, before payload evidence or incident attribution is available. We introduce a predecessor-aware release-authority record that compares each package release with its immediate predecessor across publisher, repository, workflow, provenance, signing, and mediation evidence. We apply the record to a purposefully sampled, audited April 2024June 2026 cohort from npm, PyPI, Maven Central, crates.io, and RubyGems: 45,812 releases, 43,100 eligible predecessor comparisons, and 942 package coordinates. We report Go separately as a VCS/proxy/checksum-log boundary adapter. Transparent rules identify 204 public release-path discontinuities and define a 204-release candidate review queue. A uniform semantic-distance rule selects 320 releases and covers 190/204 triggers. A descriptive regime-specific rule selects 337 releases and covers all 204. Practitioner review supports the operational reading of this queue. In a blinded 60-row shared core, three practitioners rated 20/30 triggers as immediate review, 9/30 as monitoring, 1/30 as no review, and all 30 controls as no review. External alignment defines the boundary of the surface: exact malicious versions have zero overlap with policy triggers in our cohort. Compromises that reuse the same public release path, unchanged compromised CI, and versions absent from public snapshots require separate evidence beyond this release-authority record.