title: Is there a way to assure the integrity of a published npm packages, using hashes/checksums?
body: <p>I'll be publishing an npm package on behalf of my org, say A. I'd like to give the clients a way to validate that the package they're using is actually published by A. One way of achieving this is by calculating a checksum for our sources, and publishing it somewhere on A's website. Anyone who wants to validate can do so easily. Having worked in Maven projects earlier(where checksums are generated while publishing), I was expecting that the checksum will be automatically computed in npm. However, that is not the case. Is there some way of achieving this? What's the preferred way of verifying the integrity of a package in npm?</p>
  
  <p>PS : I've looked at this thread <a href="https://github.com/npm/npm/issues/6886" rel="nofollow noreferrer">https://github.com/npm/npm/issues/6886</a>, which talks about something similar.</p>