npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of lit, generated . This is the latest read-only snapshot.
Run your own audit →

Audit of lit

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
38.5% (5) staged or trusted
Any trust
69.2% (9) incl. provenance
No trust signal
30.8% (4) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%6/308/259/89/159/23
  1. ...
    9/13 any trust
  2. 0/0 any trust
  3. 9/13 any trust
  4. ...
    9/13 any trust
  5. 9/13 any trust
  6. 9/13 any trust
  7. 0/0 any trust
  8. ...
    9/13 any trust
  9. ...
    9/13 any trust
  10. 0/0 any trust
  11. 9/13 any trust
  12. 9/13 any trust
  13. 0/0 any trust
  14. ...
    9/13 any trust
  15. 0/0 any trust
  16. 9/13 any trust
  17. 9/13 any trust
  18. ...
    9/13 any trust
  19. ...
    9/13 any trust
  20. ...
    9/13 any trust
  21. 0/0 any trust
  22. 9/13 any trust
  23. 9/13 any trust
  24. 9/13 any trust
  25. 9/13 any trust
  26. 0/0 any trust
  27. ...
    9/13 any trust
  28. ...
    9/13 any trust
  29. 9/13 any trust
  30. 9/13 any trust
  31. 0/0 any trust
In scope
13
Staged publish
0
Trusted publisher
5
Provenance only
4
No trust signal
4
Deprecated latest
0
13 packages · click a column to sort
Package trust level report
wireit0.15.0noneaomarks112,552—
lit-html3.3.3trusted publisherGitHub Actions4,361,544—
lit3.3.3trusted publisherGitHub Actions4,381,290—
@lit/localize-tools0.8.2trusted publisherGitHub Actions21,845—
@lit/reactive-element2.1.2trusted publisherGitHub Actions4,131,620—
lit-element4.2.2trusted publisherGitHub Actions4,184,899—
playground-elements0.21.2noneaomarks1,199—
@lit/task1.0.3provenancelit-robot?—
@lit/react1.0.8provenancelit-robot2,050,368—
@lit/context1.1.6provenancelit-robot?—
tachometer0.7.2noneaomarks7,214—
@lit/ts-transformers2.0.2provenancelit-robot258—
@lit/localize0.12.2nonelit-robot74,356—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal