Web Security · Senior · Question 51 of 75
What does npm package provenance give you?
- 1Faster installs through caching
- ✓Correct answer: A signed link between a published package and the source repository and CI build that produced it
- 3A guarantee that the package has no vulnerabilities
Explanation
Provenance shows the package wasn't published from someone's laptop with a stolen token. It doesn't prove the code is good.