FYI there is a push to standardize this stuff under the name of SCITT in IETF [1]. In this case (blog post) this is different as NPM is using in-toto attestation [5] (a description of a thing) and logs it in Google's provided append only log (transparency service). They are trying to make this thing being adopted through a freemium model at the moment.
One issue here is that NIST are trying to push SBOMs [2] but NPM is not providing them as part of the provenance I think.
Another thing is a push to use new types of signature envelopes like DSSE [3] instead of something like COSE [4]
[1] https://datatracker.ietf.org/group/scitt/about/
[2] https://www.nist.gov/itl/executive-order-14028-improving-nat...
[3] https://github.com/secure-systems-lab/dsse