npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of fast-check, generated . This is a read-only snapshot.
Run your own audit →

Audit of fast-check

Re-run this audit
Tracking daily next

Progress over time

Strong trust
72.7% (8) staged or trusted
Any trust
81.8% (9) incl. provenance
No trust signal
18.2% (2) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/248/269/8
  1. ...
    9/11 any trust
  2. ...
    9/11 any trust
  3. ...
    9/11 any trust
  4. ...
    9/11 any trust
  5. ...
    9/11 any trust
  6. [viewing]
    9/11 any trust
  7. 9/11 any trust
  8. 9/11 any trust
  9. 9/11 any trust
  10. ...
    9/11 any trust
In scope
11
Staged publish
3
Trusted publisher
5
Provenance only
1
No trust signal
2
Deprecated latest
2
11 packages · click a column to sort
Package trust level report
pure-rand8.4.2staged publishGitHub Actions72,247,181
fast-check4.9.0staged publishGitHub Actions35,918,716
@fast-check/packaged0.7.1staged publishGitHub Actions69
@fast-check/ava3.0.1trusted publisherGitHub Actions5,980
@fast-check/vitest0.4.1trusted publisherGitHub Actions271,262
@fast-check/poisoning0.3.0trusted publisherGitHub Actions347
@fast-check/worker0.6.0trusted publisherGitHub Actions36
@fast-check/jest2.2.0trusted publisherGitHub Actions329,247
@fast-check/expect-type0.2.1provenancendubien110DEPRECATED
ava-fast-check6.0.0nonendubien72DEPRECATED
jsverify-to-fast-check0.0.3nonendubien10