FYI: `npm publish` reports the current commit hash, if any, and this is publically viewable from the npm registry. This should help audit/verify if publishers

FYI: `npm publish` reports the current commit hash, if any, and this is publically viewable from the npm registry. This should help audit/verify if publishers have published what they say and if builds are reproducible. E.g. $ curl -sL https://registry.npmjs.com/colors | jq -r '.versions|map([.version, .gitHead]|@tsv)|.[]'