Unverified50% confidenceFactExact time
Combined with npm's provenance mechanism, dependents can trace which repository, which commit, and which CI process produced a given release version.
1
Sources
50%
Confidence
Long-term
Relevance
11/2/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe release commit carries a GPG signature, which together with the npm provenance mechanism makes the package origin traceable, allowing users to verify that the installed package was produced by that repository's CI.80% similarUnverifiedThe provenance attestation of an npm package is based on Sigstore, making it traceable which CI pipeline and which commit built the package.77% similarVerifiedThe npm ecosystem also has a provenance mechanism, which can bind release artifacts to their source repository and build pipeline and generate publicly verifiable attestations.75% similarVerifiedDevelopers can verify the signature integrity of packages via the npm audit signatures command.66% similarUnverifiedDownstream projects can use tools such as npm audit, Dependabot, or Renovate to automatically track patch updates.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1128187API
curl https://kongchang.com/api/v1/knowledge/claims/1128187MCP
get_claim(id=1128187)