GitHub this week introduced NPM package provenance and deployment protection rules and announced general availability of private vulnerability reporting.