Example report
Strong trust
40% (24) staged or trusted
Any trust
65% (39) incl. provenance
No trust signal
35% (21) no trust metadata detected
Every package owned by acme, tracked daily.
Recent reports
Latest saved auditsConfiguration
vercel
One or more npm org slugs (up to 5).
Reports
GitHub Actions
Publishers to treat as automation. Note: npm cannot distinguish a human from that human’s CI token, so “manual” is a proxy, not proof.
→ audit vercel | reports: trust
→ scope: ALL org packages
[trust] listing packages in: vercel
[trust] 191 packages; checking latest release metadata...
[trust] resolved 100/191
[trust] resolved 191/191
[trust] in scope (ALL org packages): 191 packages
[trust] checking trust status (191)...
[trust] trust 25/191
[trust] trust 50/191
[trust] trust 75/191
[trust] trust 100/191
[trust] trust 125/191
[trust] trust 150/191
[trust] trust 175/191
[trust] trust 191/191
[trust] fetching weekly downloads (164 scoped)...
audit running
Live log shows audit progress and warnings.
Progress over time
Strong trust
20.4% (39) staged or trusted
Any trust
21.5% (41) incl. provenance
No trust signal
78.5% (150) no trust metadata detected
- 41/191 any trust
- 41/188 any trust
- 40/187 any trust
- 40/187 any trust
- 40/187 any trust
- 40/187 any trust
- 40/186 any trust
- 40/186 any trust
- 37/179 any trust
- 37/179 any trust
- 37/179 any trust
- 37/179 any trust
- 37/179 any trust
- 38/178 any trust
- 38/178 any trust
- 38/178 any trust
- 38/178 any trust
- 37/178 any trust
- 37/177 any trust
- 37/176 any trust
- 37/176 any trust
- 37/176 any trust
- 37/176 any trust
- 36/176 any trust
“Recency” is the latest dist-tag’s publish time. “Manual” means the publisher isn’t in your bot-exclusion list — npm can’t tell a human session from that account’s automation token.
User publish history
standalone — by npm accountVersions attributed to a specific npm publisher within the window. This scans that account’s maintained packages, optionally combined with packages from the last audit run.