In the npm ecosystem, GPG signatures are often combined with provenance attestation to prove that a package version was built by a designated CI pipeline from a specific repository and commit, reducing the risk of dependencies being replaced or poisoned.