It's a really simple service that fetches a list of script URLs that you provide, and notifies you with the before/after diff whenever the file changes.
I found GuardScript through a Show HN a while ago (https://news.ycombinator.com/item?id=20265141) and have been very pleased with it.
https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
For example, here is Stripe's script tag:
<script src="https://js.stripe.com/v3/"></script>
SRI only works for static files whose contents never change. In this example, it would mean that Stripe could never push minor bug fixes to the SDK.
The workaround would be to use static versioned files instead of a generic script URL (or self-host the script), so that the value of the SRI checksum never changes.
Edit: In the case of Twilio, their docs say "By linking directly to our CDN in production, any patch-level (non-breaking) changes made to the SDK will automatically be applied [...]" meaning that if you link to Twilio's CDN, you can't expect the file to be static, and therefore can't use SRI.