REPRODUCIBILITY VS PROVENANCE: TRUSTING THE JAVASCRIPT SUPPLY CHAIN

Summary from the TLDR Web Dev newsletter

The JavaScript package ecosystem faces security threats despite efforts to establish provenance by tracking package origins. "Reproduce" is a new open-source tool that independently verifies if an npm package can be rebuilt from its declared source. This tool fetches source metadata, clones the repository, runs build steps, and compares the resulting artifact with the published package to ensure reproducibility. Testing against the top 5,000 "high impact" npm packages, Reproduce found that only 5.78% of packages were reproducible.