Attestations for
  ghcr.io/kapsl-sh/npm@sha256:3ed8fd5b99c56e0e8ae8e7671053a44ab09f9b682348192643fe28c6ba02974e

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/kapsl-sh/npm@sha256:3ed8fd5b99c56e0e8ae8e7671053a44ab09f9b682348192643fe28c6ba02974e

=== cyclonedx ===================================================
  subject   ghcr.io/kapsl-sh/npm
  digest    sha256:3ed8fd5b99c56e0e8ae8e7671053a44ab09f9b682348192643fe28c6ba02974e
  states    145 component(s) are inside this image
      @gar/promise-retry     1.0.3                    pkg:npm/%40gar/promise-retry@1.0.3
      @isaacs/fs-minipass    4.0.1                    pkg:npm/%40isaacs/fs-minipass@4.0.1
      @isaacs/string-locale-compare 1.1.0                    pkg:npm/%40isaacs/string-locale-compare@1.1.0
      @npmcli/agent          5.0.2                    pkg:npm/%40npmcli/agent@5.0.2
      @npmcli/arborist       10.0.2                   pkg:npm/%40npmcli/arborist@10.0.2
      @npmcli/config         11.0.1                   pkg:npm/%40npmcli/config@11.0.1
      @npmcli/fs             6.0.0                    pkg:npm/%40npmcli/fs@6.0.0
      @npmcli/git            8.0.0                    pkg:npm/%40npmcli/git@8.0.0
      @npmcli/installed-package-contents 5.0.0                    pkg:npm/%40npmcli/installed-package-contents@5.0.0
      @npmcli/map-workspaces 6.0.0                    pkg:npm/%40npmcli/map-workspaces@6.0.0
      @npmcli/metavuln-calculator 10.0.0                   pkg:npm/%40npmcli/metavuln-calculator@10.0.0
      @npmcli/name-from-folder 5.0.0                    pkg:npm/%40npmcli/name-from-folder@5.0.0
      ... and 133 more

=== slsaprovenance ==============================================
  subject   ghcr.io/kapsl-sh/npm
  digest    sha256:3ed8fd5b99c56e0e8ae8e7671053a44ab09f9b682348192643fe28c6ba02974e
  build     https://index.kapsl.sh/buildtype/v1
  builder   https://index.kapsl.sh
  from      6 resolved input(s)
      base-image         ghcr.io/kapsl-sh/kapsl-base-static:latest
      composed-image     compose:bash
      composed-image     compose:env
      composed-image     compose:node
      composed-image     compose:node@26
      composed-image     compose:npm
  sbom      sbom.json sha256:4d10514f3e4ec0fef2664278f3a4c3d9...