I'm not really familiar with how NPM packages are published - is it just referencing a commit hash in a repo, or is it a separate upload direct? If it's the fo

I'm not really familiar with how NPM packages are published - is it just referencing a commit hash in a repo, or is it a separate upload direct? If it's the former (or could be made to be the former), requiring GPG signed commits would go a long way to preventing malicious activity.