npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of bluesky-social, generated . This is a read-only snapshot.
Run your own audit →

Audit of bluesky-social

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
0% (0) staged or trusted
Any trust
0% (0) incl. provenance
No trust signal
100% (34) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/259/9
  1. ...
    0/34 any trust
  2. ...
    0/34 any trust
  3. ...
    0/34 any trust
  4. ...
    0/34 any trust
  5. 0/34 any trust
  6. 0/34 any trust
  7. [viewing]
    0/34 any trust
In scope
34
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
34
Deprecated latest
0
34 packages · click a column to sort
Package trust level report
@bluesky-social/api0.17.3noneweb3km14—
@bluesky-social/ozone0.1.148noneweb3km2—
@bluesky-social/pds0.4.185noneweb3km0—
@bluesky-social/xrpc-server0.9.5noneweb3km2—
@bluesky-social/xrpc0.7.5noneweb3km2,084—
@bluesky-social/syntax0.4.1noneweb3km2,095—
@bluesky-social/repo0.8.10noneweb3km3—
@bluesky-social/sync0.1.35noneweb3km3—
@bluesky-social/oauth-client-browser-example0.0.6noneweb3km0—
@bluesky-social/oauth-provider-frontend0.2.2noneweb3km3—
@bluesky-social/oauth-provider0.13.2noneweb3km1—
@bluesky-social/oauth-types0.4.2noneweb3km2,083—
@bluesky-social/oauth-provider-ui0.3.2noneweb3km4—
@bluesky-social/oauth-scopes0.2.1noneweb3km2—
@bluesky-social/oauth-client-node0.3.9noneweb3km2,090—
@bluesky-social/oauth-provider-api0.3.1noneweb3km1—
@bluesky-social/oauth-client-expo0.0.1noneweb3km3—
@bluesky-social/bsky0.0.189noneweb3km1—
@bluesky-social/oauth-client0.5.7noneweb3km2,083—
@bluesky-social/oauth-client-browser0.3.33noneweb3km1—
@bluesky-social/lexicon0.5.1noneweb3km2,091—
@bluesky-social/jwk0.6.0noneweb3km2,078—
@bluesky-social/lexicon-resolver0.2.2noneweb3km3—
@bluesky-social/jwk-webcrypto0.2.0noneweb3km2,079—
@bluesky-social/jwk-jose0.1.11noneweb3km2,080—
@bluesky-social/dev-env0.3.182noneweb3km0—
@bluesky-social/did0.2.1noneweb3km2,084—
@bluesky-social/bsync0.0.22noneweb3km1—
@bluesky-social/lex-cli0.9.5noneweb3km11—
@bluesky-social/common-web0.4.3noneweb3km2,091—
@bluesky-social/identity0.4.9noneweb3km11—
@bluesky-social/aws0.2.30noneweb3km0—
@bluesky-social/common0.4.12noneweb3km3—
@bluesky-social/crypto0.4.4noneweb3km13—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal