Publishing with npm publish --provenance (automatic with trusted publishing) from GitHub Actions or GitLab CI creates an in-toto attestation signed with a Sigstore certificate for the workflow identity and logged in Rekor; the registry stores it and shows a provenance badge. npm audit signatures verifies registry signatures and provenance attestations of installed packages.
Provenance is available only for public packages built from public repositories. It does not vouch for the code itself, and a compromised workflow still produces valid provenance, but it stops a stolen token from publishing a "provenanced" version from elsewhere. The npm provenance checker shows a package version's attestation and its source.