npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Supply-chain trust signals for npm orgs. Audit, visualize, share, track over time.

Example report
Strong trust
40% (24) staged or trusted
Any trust
65% (39) incl. provenance
No trust signal
35% (21) no trust metadata detected

Every package owned by acme, tracked daily.

Strong trust Any trust No trust signal
0%50%100%6/226/277/17/87/127/19
Run your own audit ↓

Recent reports

Latest saved audits
  1. vercel
  2. gatsbyjs, netlify
  3. fast-check
  4. astrojs
  5. gameroman
  6. … 13 more

Configuration

One or more npm org slugs (up to 5).

Reports
GitHub Actions

Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.

audit · stream
Enter npm orgs, choose report(s), and hit Run Audit.

Live log shows audit progress and warnings.

“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.

User publish history

standalone — by npm account

Versions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal