npm provenance

Key Takeaways npm provenance proves which repository, commit and workflow produced a package, not that the code is safe to run. The attestation gap is the space between what provenance...