six steps from a published npm package to a verified public identity. Each one reports its own state from the server, so a reload never shows a step as done when it is not.
from npm: the package's public record, which is the same document anyone can fetch from the registry. From GitHub: your login and avatar, your verified email addresses, and your permission on the one repository you ask us to check.
nothing is written to your repository or to the registry on your behalf. We never publish a version for you: the proof step asks you to publish one, which is exactly why it proves something.
importing a package records what npm says about it and gives you nothing. Linking its repository shows you control that repository. Only the publish proof, or npm's own attestation, makes a package verified, and the public page always shows which of those happened.