npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of bluesky-social, generated . This is a read-only snapshot.
Run your own audit →

Audit of bluesky-social

Re-run this audit
Tracking daily next

Progress over time

Strong trust
0% (0) staged or trusted
Any trust
0% (0) incl. provenance
No trust signal
100% (34) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/259/69/9
  1. ... [viewing]
    0/34 any trust
    1. [viewing]
  2. ...
    0/34 any trust
  3. ...
    0/34 any trust
  4. ...
    0/34 any trust
  5. 0/34 any trust
  6. 0/34 any trust
  7. 0/34 any trust
In scope
34
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
34
Deprecated latest
0
34 packages · click a column to sort
Package trust level report
@bluesky-social/api0.17.3noneweb3km28
@bluesky-social/ozone0.1.148noneweb3km8
@bluesky-social/pds0.4.185noneweb3km8
@bluesky-social/xrpc-server0.9.5noneweb3km9
@bluesky-social/xrpc0.7.5noneweb3km1,312
@bluesky-social/syntax0.4.1noneweb3km1,324
@bluesky-social/repo0.8.10noneweb3km7
@bluesky-social/sync0.1.35noneweb3km9
@bluesky-social/oauth-client-browser-example0.0.6noneweb3km7
@bluesky-social/oauth-provider-frontend0.2.2noneweb3km7
@bluesky-social/oauth-provider0.13.2noneweb3km8
@bluesky-social/oauth-types0.4.2noneweb3km1,305
@bluesky-social/oauth-provider-ui0.3.2noneweb3km7
@bluesky-social/oauth-scopes0.2.1noneweb3km5
@bluesky-social/oauth-client-node0.3.9noneweb3km1,306
@bluesky-social/oauth-provider-api0.3.1noneweb3km6
@bluesky-social/oauth-client-expo0.0.1noneweb3km8
@bluesky-social/bsky0.0.189noneweb3km9
@bluesky-social/oauth-client0.5.7noneweb3km1,312
@bluesky-social/oauth-client-browser0.3.33noneweb3km22
@bluesky-social/lexicon0.5.1noneweb3km1,319
@bluesky-social/jwk0.6.0noneweb3km1,316
@bluesky-social/lexicon-resolver0.2.2noneweb3km4
@bluesky-social/jwk-webcrypto0.2.0noneweb3km1,305
@bluesky-social/jwk-jose0.1.11noneweb3km1,308
@bluesky-social/dev-env0.3.182noneweb3km9
@bluesky-social/did0.2.1noneweb3km1,311
@bluesky-social/bsync0.0.22noneweb3km8
@bluesky-social/lex-cli0.9.5noneweb3km9
@bluesky-social/common-web0.4.3noneweb3km1,315
@bluesky-social/identity0.4.9noneweb3km14
@bluesky-social/aws0.2.30noneweb3km7
@bluesky-social/common0.4.12noneweb3km10
@bluesky-social/crypto0.4.4noneweb3km9