npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of astro, generated . This is a read-only snapshot.
Run your own audit →

Audit of astro

Re-run this audit
Package trust only.

Progress over time

Strong trust
0% (0) staged or trusted
Any trust
0% (0) incl. provenance
No trust signal
100% (22) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/2410/1210/23
  1. ...
    0/22 any trust
  2. ...
    0/22 any trust
  3. [viewing]
    0/22 any trust
  4. 0/22 any trust
  5. ...
    0/22 any trust
In scope
22
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
22
Deprecated latest
0
22 packages · click a column to sort
Package trust level report
ltx3.1.2nonesonny37,505—
node-expat2.4.1noney--107,956—
react-native-basic-xmpp1.0.11nonegarthenweb387—
oembed0.1.2noneastro239—
collectdout0.0.9noneastro49—
node-stringprep0.8.0noneastro469—
superfeedr-pshb0.0.0noneastro2—
osm-pbf-parser2.3.0nonesubstack8,779—
spacesocket0.0.1none?9—
openpixelcontrol0.0.0noneastro6—
sawrocket0.2.1nonedodo10—
webseeded-torrent-generator0.9.0nonepwmckenna30—
dat-elasticsearch-upload0.0.0noneastro7—
dat-osm-import0.0.0noneastro12—
osm-poi-db0.0.2noneastro14—
bittorrent-tracker-client0.0.2noneastro21—
dns-srv0.3.0nonedhruvbird55—
vnc-client0.0.0noneastro11—
sasljs0.0.1noneastro6—
bedtime0.0.2noneastro11—
node-base640.0.1none?1,275—
channel-server0.0.1none?10—