I audited the top 50 npm packages. Almost none ship with supply-chain attestations!

TL;DR I checked 50 of the most-downloaded npm packages last week to see how many ship with...