Unverified50% confidenceFactExact time
GitHub's Trusted Publishing combined with GPG signing mechanisms can prove that a given npm package was indeed published by the CI/CD pipeline of a specific repository.
1
Sources
50%
Confidence
Long-term
Relevance
10/9/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.78% similarVerifiedVercel uses an automated release process in which releases are automatically triggered by github-actions, and commits are verified with GPG signatures.65% similarVerifiedThis release record was completed by a GitHub Actions automated workflow and carries an official GitHub verified signature (Verified).65% similarUnverifiedGitHub Actions can be combined with OIDC (OpenID Connect) token mechanisms to publish npm packages, establishing a trusted chain from code submission to artifact publication.64% similarUnverifiedAfter GPG signature verification passes, GitHub displays a green "Verified" badge, proving the commit originated from the account holding the corresponding private key64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/990158API
curl https://kongchang.com/api/v1/knowledge/claims/990158MCP
get_claim(id=990158)