This is where attestation/sigstore comes into play. Github has a first-party action for it and I wish more projects would use it. Regarding javascript specifica

This is where attestation/sigstore comes into play. Github has a first-party action for it and I wish more projects would use it. Regarding javascript specifically, I believe npm has builtin support for sigstore. * https://docs.github.com/en/actions/concepts/security/artifact-attestations https://docs.github.com/en/actions/concepts/security/artifac... * https://www.sigstore.dev/ https://www.sigstore.dev/ * https://github.com/actions/attest https://github.com/actions/attest