Score supply chain risk for npm, PyPI, Cargo, and Go packages.
Check that a source really says what your claim says, before you publish. Verbatim, multi-path.
