Example report
Strong trust
40% (24) staged or trusted
Any trust
65% (39) incl. provenance
No trust signal
35% (21) no trust metadata detected
Every package owned by acme, tracked daily.
Recent reports
Latest saved auditsConfiguration
nuxt
One or more npm org slugs (up to 5).
Reports
GitHub Actions
Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.
→ audit nuxt | reports: trust
→ scope: ALL org packages
[trust] listing packages in: nuxt
[trust] 157 packages; checking latest release metadata...
[trust] resolved 100/157
[trust] resolved 157/157
[trust] in scope (ALL org packages): 157 packages
[trust] checking trust status (157)...
[trust] trust 25/157
[trust] trust 50/157
[trust] trust 75/157
[trust] trust 100/157
[trust] trust 125/157
[trust] trust 150/157
[trust] trust 157/157
[trust] fetching weekly downloads (142 scoped)...
[trust] downloads 20/157
audit running
Live log shows audit progress and warnings.
Progress over time
Strong trust
33.8% (53) staged or trusted
Any trust
48.4% (76) incl. provenance
No trust signal
51.6% (81) no trust metadata detected
- 76/157 any trust
- 76/157 any trust
- 76/156 any trust
- 74/155 any trust
- 74/155 any trust
- 74/154 any trust
- 74/154 any trust
- 74/154 any trust
- 74/154 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 73/152 any trust
- 72/150 any trust
“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.
User publish history
standalone — by npm accountVersions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.