X_REGISTRY_UNATTESTED
Means
the stamped version is on the registry with no dist.attestations, published by a person
Typical cause
it was published by hand rather than by release.yml, so nothing proves the workflow built that tarball. Every @ultimat3/* package at 2.0.0 is in this state
Fix
bun run scripts/trust-publishers.ts --json, then release the next version through the workflow (bun run scripts/release.ts --bump patch) — npm publishes are immutable, so the affected version can never gain an attestation