Unexpected manual publishes of @crossmint/wallets-sdk v0.20.4 and v0.20.5 — are these intentional?

[varunsh-coder]

Summary

We noticed that @crossmint/wallets-sdk versions 0.20.4 and 0.20.5 were published to npm recently, but they don't appear in the CHANGELOG and were published after the package had already moved to the 1.0.x line. We wanted to flag this in case it wasn't intentional.

Details

Timeline anomaly

The changelog shows versions progressing as:

0.20.0 → 0.20.1 → 0.20.2 → 0.21.0 → 1.0.0-beta.x → 1.0.1 … 1.0.13

Versions 0.20.3, 0.20.4, and 0.20.5 are not in the changelog, but were published to npm retroactively:

Version	Published	Publisher	fileCount	Unpacked Size
0.20.2	2026-03-12	GitHub Actions (OIDC trusted publisher, SLSA provenance)	257	1.77 MB
0.21.0	2026-03-18	GitHub Actions	—	—
0.20.4	2026-04-10	albertoelias-xm (human account)	423	2.45 MB
0.20.5	2026-04-15	albertoelias-xm (human account)	1	1.3 KB
1.0.13	2026-04-15	GitHub Actions (OIDC trusted publisher)	—	—

Publisher difference

All regular releases are published by GitHub Actions via OIDC trusted publisher with SLSA provenance attestations. These two versions were published by a human npm account (albertoelias-xm) without provenance.

Package issues

• v0.20.4 contains workspace:* references in its dependencies (e.g. "@crossmint/client-signers": "workspace:*"), which suggests it was published manually from the monorepo without going through the changeset/release tooling. This would break installs for consumers since workspace:* is a pnpm-internal protocol.

• v0.20.5 contains only package.json — no dist/ directory, no actual code. The package is non-functional (require('@crossmint/wallets-sdk') fails with Cannot find module './dist/index.cjs').

• A legacy dist-tag has been set pointing to v0.20.5.

Potential impact

Users pinned to semver ranges like ~0.20.2 or ^0.20.0 could be upgraded to these broken versions.

Questions

1. Were these publishes intentional (e.g. to create a legacy release channel)?
2. If not, should these versions be unpublished or deprecated on npm?
3. Would it be worth restricting npm publish to the CI pipeline only (via npm automation tokens / OIDC) to prevent accidental manual publishes?