Attestations for
  ghcr.io/boks-sh/npm@sha256:14746fee8d1b8e43e35bc25367a04ced09b9c0b80df5153f2aa97e821c084d55

Verify them yourself:
  cosign verify-attestation --key cosign.pub \
      --type <cyclonedx|slsaprovenance> ghcr.io/boks-sh/npm@sha256:14746fee8d1b8e43e35bc25367a04ced09b9c0b80df5153f2aa97e821c084d55

=== cyclonedx ===================================================
  subject   ghcr.io/boks-sh/npm
  digest    sha256:14746fee8d1b8e43e35bc25367a04ced09b9c0b80df5153f2aa97e821c084d55
  states    145 component(s) are inside this image
      @gar/promise-retry     1.0.3                    pkg:npm/%40gar/promise-retry@1.0.3
      @isaacs/fs-minipass    4.0.1                    pkg:npm/%40isaacs/fs-minipass@4.0.1
      @isaacs/string-locale-compare 1.1.0                    pkg:npm/%40isaacs/string-locale-compare@1.1.0
      @npmcli/agent          5.0.2                    pkg:npm/%40npmcli/agent@5.0.2
      @npmcli/arborist       10.0.2                   pkg:npm/%40npmcli/arborist@10.0.2
      @npmcli/config         11.0.1                   pkg:npm/%40npmcli/config@11.0.1
      @npmcli/fs             6.0.0                    pkg:npm/%40npmcli/fs@6.0.0
      @npmcli/git            8.0.0                    pkg:npm/%40npmcli/git@8.0.0
      @npmcli/installed-package-contents 5.0.0                    pkg:npm/%40npmcli/installed-package-contents@5.0.0
      @npmcli/map-workspaces 6.0.0                    pkg:npm/%40npmcli/map-workspaces@6.0.0
      @npmcli/metavuln-calculator 10.0.0                   pkg:npm/%40npmcli/metavuln-calculator@10.0.0
      @npmcli/name-from-folder 5.0.0                    pkg:npm/%40npmcli/name-from-folder@5.0.0
      ... and 133 more

=== slsaprovenance ==============================================
  subject   ghcr.io/boks-sh/npm
  digest    sha256:14746fee8d1b8e43e35bc25367a04ced09b9c0b80df5153f2aa97e821c084d55
  build     https://index.boks.sh/buildtype/v1
  builder   https://index.boks.sh
  from      6 resolved input(s)
      base-image         ghcr.io/boks-sh/boks-base-static-ubuntu:latest
      composed-image     compose:bash
      composed-image     compose:env
      composed-image     compose:node
      composed-image     compose:node@26
      composed-image     compose:npm
  sbom      sbom.json sha256:5aa31e133cb693dedb9f62e1d3f609c5...