Verified75% confidenceFactExact time
GitHub trusted signing (Sigstore/GitHub Attestations) verifies the provenance of release artifacts through cryptographic endorsement, serving as a means of strengthening npm supply chain security.
3
Sources
75%
Confidence
Long-term
Relevance
9/22/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedGitHub attestation allows users to verify, through commands such as gh attestation verify, that a certain npm package was indeed built from the specified repository and commit.79% similarUnverifiedGitHub's Trusted Publishing combined with GPG signing mechanisms can prove that a given npm package was indeed published by the CI/CD pipeline of a specific repository.78% similarUnverifiedThe open-source code being publicly hosted on GitHub allows third parties to audit and verify whether the code's behavior is consistent with what is advertised.78% similarUnverifiedHansel 的分类标签中包含 GitHub，暗示其可能采用开源或部分开源方式发布，符合安全领域'Don't trust, verify'原则75% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/941836API
curl https://kongchang.com/api/v1/knowledge/claims/941836MCP
get_claim(id=941836)