Example report
Strong trust
40% (24) staged or trusted
Any trust
65% (39) incl. provenance
No trust signal
35% (21) no trust metadata detected
Every package owned by acme, tracked daily.
Recent reports
Latest saved auditsConfiguration
gameroman
One or more npm org slugs (up to 5).
Reports
GitHub Actions
Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.
→ audit gameroman | reports: trust,manual
→ scope: ALL org packages
[trust] listing packages in: gameroman
[trust] 142 packages; checking latest release metadata...
audit running
Live log shows audit progress and warnings.
Progress over time
Strong trust
10.6% (15) staged or trusted
Any trust
10.6% (15) incl. provenance
No trust signal
89.4% (127) no trust metadata detected
- 15/137 any trust
- 15/137 any trust
- 15/137 any trust
- 15/135 any trust
- 15/135 any trust
- 15/135 any trust
- 15/133 any trust
- 15/131 any trust
- 15/131 any trust
- 15/131 any trust
- 15/131 any trust
- 15/131 any trust
- 15/131 any trust
- 15/128 any trust
- 15/129 any trust
- 14/117 any trust
“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.
User publish history
standalone — by npm accountVersions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.