# Upstream Supply-Chain Evidence Request

Package: <name>
Version reviewed: <version>
Repository: <url>
AIWG tracking issue: <issue>

## Summary

AIWG is reviewing third-party npm package provenance and lifecycle behavior for dependencies shipped in its package or used by maintainers. During review, we could not verify the following evidence:

- <signed release tag / trusted publishing attestation / lifecycle script rationale / private package source link>

## Requested Clarification

Please confirm:

- the canonical source ref for npm version <version>;
- whether npm releases are produced by trusted publishing or a documented release workflow;
- whether release tags are signed, and how consumers should verify them;
- why any install-time or release-time lifecycle scripts are necessary.

## Notes

This is a documentation/provenance request unless a concrete exploitability finding is attached. Human review is required before filing upstream.