Tag

npm-provenance

Safeguard articles tagged "npm-provenance" — guides, analysis, and best practices for software supply chain and application security.

1 article

Engineering

npm Provenance Statements: What They Prove and What They Don't

npm provenance ties a package to the commit and CI run that built it. That's genuinely useful — and narrower than most teams assume. Here's the exact boundary.

Feb 11, 20266 min read