Secure, reproducible builds for NPM

RFC: <a href="https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;16&#x2F;files?short_path=5c765e6" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;npm&#x2F;rfcs&#x2F;pull&#x2F;16&#x2F;files?short_path=5c765e6</a><p>Summarized algorithm: <a href="https:&#x2F;&#x2F;cdn-images-1.medium.com&#x2F;max&#x2F;800&#x2F;1*1b7KHDG2St5D-6jepfMhNA.png" rel="nofollow">https:&#x2F;&#x2F;cdn-images-1.medium.com&#x2F;max&#x2F;800&#x2F;1*1b7KHDG2St5D-6jepf...</a>

Good luck with the PR. After recent events, it&#x27;s good to see ideas like this make it back upstream for serious discussion.