npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Supply-chain trust signals for npm orgs. Audit, visualize, share, track over time.

Recent reports

Latest saved audits
  1. lit
  2. gatsbyjs, netlify
  3. atproto
  4. nuxt
  5. cloudflare
  6. … 13 more

Configuration

Vue

One or more npm org slugs (up to 5).

Reports
GitHub Actions

Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.

audit · stream
→ audit Vue | reports: trust,manual
→ scope: ALL org packages
[trust] listing packages in: Vue
[trust] 0 packages; checking latest release metadata...
[trust] in scope (ALL org packages): 0 packages
[trust] checking trust status (0)...
[trust] fetching weekly downloads (0 scoped)...
[trust] provenance=0 trustedPublisher=0 stagedPublish=0 deprecated=0 of 0
[manual] scanning 0 packages for publishes in last 12 months...
[manual] 0 manual publishes (of 0 scanned)
Done.

Live log shows audit progress and warnings.

Report ready 0 package trust rows · 0 manual publishes

Progress over time

Strong trust
28.4% (33) staged or trusted
Any trust
29.3% (34) incl. provenance
No trust signal
70.7% (82) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/98/279/59/1510/310/16
  1. 34/116 any trust
  2. 34/116 any trust
  3. 34/116 any trust
  4. 0/0 any trust
  5. 0/0 any trust
  6. 34/116 any trust
  7. 34/116 any trust
  8. ...
    34/115 any trust
  9. 34/115 any trust
  10. ...
    34/115 any trust
  11. 0/0 any trust
  12. ...
    34/115 any trust
  13. 0/0 any trust
  14. 34/115 any trust
  15. ...
    34/115 any trust
  16. 34/115 any trust
  17. 34/115 any trust
  18. 0/0 any trust
  19. 34/115 any trust
  20. ...
    34/115 any trust
  21. 34/115 any trust
  22. 0/0 any trust
  23. ...
    34/115 any trust
  24. 0/0 any trust
  25. 34/115 any trust
  26. 34/115 any trust
  27. 34/115 any trust
  28. 34/115 any trust
  29. 0/0 any trust
  30. ...
    34/115 any trust
  31. 34/115 any trust
  32. ...
    34/115 any trust
  33. 0/0 any trust
  34. 34/115 any trust
  35. 34/115 any trust
  36. 34/115 any trust
  37. 34/115 any trust
  38. 34/115 any trust
  39. 34/115 any trust
  40. 34/115 any trust
  41. ...
    34/115 any trust
  42. 34/115 any trust

Audit results

In scope
0
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
0
Deprecated latest
0
0 packages · click a column to sort
Package trust level report

“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.

User publish history

standalone — by npm account

Versions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal