What can you see behind a package?

Public observation · Scoped evidence

Repository and maintainer fields are registry metadata hints. They do not prove release authority or protected identity. When artifact origin is marked validated, its Sigstore signature, workflow identity and binding to the registry-reported digest have been checked. The artifact itself is not downloaded or executed. Missing verification does not mean insecure.