Example report
Strong trust
40% (24) staged or trusted
Any trust
65% (39) incl. provenance
No trust signal
35% (21) no trust metadata detected
Every package owned by acme, tracked daily.
Recent reports
Latest saved auditsConfiguration
astrojs
One or more npm org slugs (up to 5).
Reports
GitHub+Actions
Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.
→ audit astrojs | reports: trust,manual
→ scope: ALL org packages
[trust] listing packages in: astrojs
[trust] 76 packages; checking latest release metadata...
[trust] resolved 76/76
[trust] in scope (ALL org packages): 76 packages
[trust] checking trust status (76)...
[trust] trust 25/76
[trust] trust 50/76
[trust] trust 75/76
[trust] trust 76/76
[trust] fetching weekly downloads (74 scoped)...
[trust] downloads 20/76
audit running
Live log shows audit progress and warnings.
Progress over time
Strong trust
61.8% (47) staged or trusted
Any trust
67.1% (51) incl. provenance
No trust signal
32.9% (25) no trust metadata detected
- 51/76 any trust
- 51/76 any trust
- 51/76 any trust
- 51/76 any trust
- 50/76 any trust
- 50/75 any trust
- 50/75 any trust
- 50/75 any trust
- 50/75 any trust
- 50/75 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
- 48/74 any trust
“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.
User publish history
standalone — by npm accountVersions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.