At the very least, that should be provided for NPM packages, since Microsoft now own NPM. Having those packages verifiably built from source could technically

At the very least, that should be provided for NPM packages, since Microsoft now own NPM. Having those packages verifiably built from source could technically be done by any trusted third party, so it's a pity that this project didn't take off: https://hackernoon.com/what-if-we-could-verify-npm-packages-c2a319cff758 https://hackernoon.com/what-if-we-could-verify-npm-packages-...