npm

The Provenance Was Valid. The Commit Was Not.

An npm provenance attestation binds a tarball to a repository, a workflow and a commit. Reading the payload shows what it never claims.