npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of atcute, generated . This is a read-only snapshot.
Run your own audit →

Audit of atcute

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
0% (0) staged or trusted
Any trust
0% (0) incl. provenance
No trust signal
100% (61) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/259/2810/25
  1. 0/61 any trust
  2. 0/61 any trust
  3. ...
    0/61 any trust
  4. ...
    0/61 any trust
  5. ...
    0/61 any trust
  6. 0/61 any trust
  7. ...
    0/61 any trust
  8. ...
    0/61 any trust
  9. ...
    0/61 any trust
  10. ... [viewing]
    0/61 any trust
    13. [viewing]
  11. ...
    0/61 any trust
  12. ...
    0/61 any trust
  13. ...
    0/61 any trust
  14. 0/61 any trust
  15. 0/61 any trust
  16. 0/61 any trust
  17. 0/61 any trust
  18. ...
    0/61 any trust
  19. ...
    0/61 any trust
  20. ...
    0/61 any trust
  21. ...
    0/61 any trust
  22. 0/61 any trust
  23. ...
    0/61 any trust
  24. ...
    0/61 any trust
  25. 0/61 any trust
  26. 0/61 any trust
  27. 0/61 any trust
  28. 0/61 any trust
In scope
61
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
61
Deprecated latest
0
61 packages · click a column to sort
Package trust level report
@atcute/car6.1.0noneexterndefs29,158—
@atcute/cid2.5.0noneexterndefs27,959—
@atcute/uint8array1.2.0noneexterndefs58,292—
@atcute/repo1.1.0noneexterndefs27,706—
@atcute/mst1.1.1noneexterndefs28,367—
@atcute/cbor2.3.8noneexterndefs32,230—
@atcute/tangled2.0.20noneexterndefs333—
@atcute/leaflet2.0.18noneexterndefs749—
@atcute/bluesky4.0.22noneexterndefs23,358—
@atcute/oauth-browser-client5.1.0noneexterndefs1,052—
@atcute/lexicons2.1.1noneexterndefs61,559—
@atcute/bluesky-search-parser0.2.0noneexterndefs18—
@atcute/identity-resolver2.0.2noneexterndefs39,822—
@atcute/did-plc1.0.2noneexterndefs321—
@atcute/xrpc-server2.0.3noneexterndefs4,010—
@atcute/ozone4.0.10noneexterndefs617—
@atcute/client5.1.2noneexterndefs55,885—
@atcute/firehose1.2.0noneexterndefs3,886—
@atcute/xrpc-server-node2.1.2noneexterndefs4—
@atcute/jetstream2.2.0noneexterndefs3,992—
@atcute/tap1.0.3noneexterndefs4—
@atcute/pckt1.0.9noneexterndefs17—
@atcute/lex-cli3.3.0noneexterndefs4,377—
@atcute/lexicon-doc3.1.0noneexterndefs4,572—
@atcute/atproto4.0.4noneexterndefs55,816—
@atcute/oauth-keyset0.1.3noneexterndefs5,480—
@atcute/password-session1.0.2noneexterndefs509—
@atcute/bluesky-threading6.0.2noneexterndefs7—
@atcute/cache1.0.2noneexterndefs6—
@atcute/bluesky-richtext-segmenter3.0.2noneexterndefs20,428—
@atcute/bluesky-moderation4.2.2noneexterndefs15—
@atcute/identity2.0.2noneexterndefs57,772—
@atcute/crypto2.4.4noneexterndefs25,682—
@atcute/tid1.1.4noneexterndefs1,571—
@atcute/multibase1.2.5noneexterndefs37,516—
@atcute/varint2.0.2noneexterndefs24,749—
@atcute/util-text-native1.0.5noneexterndefs4—
@atcute/util-text1.3.4noneexterndefs59,527—
@atcute/util-fetch2.0.2noneexterndefs39,643—
@atcute/xrpc-server-deno2.0.1noneexterndefs2—
@atcute/xrpc-server-cloudflare2.0.1noneexterndefs3,794—
@atcute/xrpc-server-bun2.0.1noneexterndefs2—
@atcute/oauth-node-client2.0.1noneexterndefs4,922—
@atcute/bluemoji4.0.2noneexterndefs8—
@atcute/bluesky-richtext-builder4.0.1noneexterndefs672—
@atcute/labeler1.0.1noneexterndefs6—
@atcute/standard-site2.0.2noneexterndefs181—
@atcute/lexicon-community2.0.4noneexterndefs6—
@atcute/frontpage3.0.2noneexterndefs10—
@atcute/whitewind4.0.2noneexterndefs13—
@atcute/microcosm2.0.2noneexterndefs67—
@atcute/germ1.0.2noneexterndefs5—
@atcute/lexicon-resolver-node1.0.1noneexterndefs14—
@atcute/oauth-cab0.1.1noneexterndefs5—
@atcute/lexicon-resolver1.0.1noneexterndefs4,502—
@atcute/identity-resolver-node2.0.1noneexterndefs406—
@atcute/oauth-types1.0.1noneexterndefs5,430—
@atcute/oauth-crypto1.0.1noneexterndefs5,645—
@atcute/time-ms1.3.3noneexterndefs1,536—
@atcute/bluesky-richtext-parser2.1.2noneexterndefs701—
@atcute/base321.0.1noneexterndefs105—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal