# X_REGISTRY_UNATTESTED

## Means

the stamped version is on the registry with no `dist.attestations`, published by a person

## Typical cause

it was published by hand rather than by `release.yml`, so nothing proves the workflow built that tarball. Every `@ultimat3/*` package at 2.0.0 is in this state

## Fix

`bun run scripts/trust-publishers.ts --json`, then release the **next** version through the workflow (`bun run scripts/release.ts --bump patch`) — npm publishes are immutable, so the affected version can never gain an attestation

[CLI and verify](/error-codes#cli-and-verify)