SLSA 1.0 specifies three different levels of compliance, called SLSA Build Level 1, 2 and 3, that can be achieved through the publication of a suitable build provenance file. (Starting at Build Level 2, the build parameters shown in the provenance must be read directly from the build platform, not provided separately by the entity invoking the build.) Thus, the best way to leverage npm’s existing support is to run npm audit signatures on every build or dependency update and to manually review the dependency list if the number of packages with verified provenance unexpectedly decreases between builds.