Attestations for
  ghcr.io/boks-sh/npm@sha256:1ed8f8eeb659672ed0f1faac2cc8b59107066e072e0658c4e8f7f1a03b5e53f1

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/npm@sha256:1ed8f8eeb659672ed0f1faac2cc8b59107066e072e0658c4e8f7f1a03b5e53f1

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/npm
  digest    sha256:1ed8f8eeb659672ed0f1faac2cc8b59107066e072e0658c4e8f7f1a03b5e53f1
  states    145 component(s) are inside this image
      @gar/promise-retry     1.0.3                    pkg:npm/%40gar/promise-retry@1.0.3
      @isaacs/fs-minipass    4.0.1                    pkg:npm/%40isaacs/fs-minipass@4.0.1
      @isaacs/string-locale-compare 1.1.0                    pkg:npm/%40isaacs/string-locale-compare@1.1.0
      @npmcli/agent          5.0.2                    pkg:npm/%40npmcli/agent@5.0.2
      @npmcli/arborist       10.0.2                   pkg:npm/%40npmcli/arborist@10.0.2
      @npmcli/config         11.0.1                   pkg:npm/%40npmcli/config@11.0.1
      @npmcli/fs             6.0.0                    pkg:npm/%40npmcli/fs@6.0.0
      @npmcli/git            8.0.0                    pkg:npm/%40npmcli/git@8.0.0
      @npmcli/installed-package-contents 5.0.0                    pkg:npm/%40npmcli/installed-package-contents@5.0.0
      @npmcli/map-workspaces 6.0.0                    pkg:npm/%40npmcli/map-workspaces@6.0.0
      @npmcli/metavuln-calculator 10.0.0                   pkg:npm/%40npmcli/metavuln-calculator@10.0.0
      @npmcli/name-from-folder 5.0.0                    pkg:npm/%40npmcli/name-from-folder@5.0.0
      ... and 133 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/npm
  digest    sha256:1ed8f8eeb659672ed0f1faac2cc8b59107066e072e0658c4e8f7f1a03b5e53f1
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      6 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:bash
      composed-image     compose:env
      composed-image     compose:node
      composed-image     compose:node@26
      composed-image     compose:npm
  sbom      sbom.json sha256:acdc1aba218db6003fb45941a40c1efa...