npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of fast-check, generated . This is a read-only snapshot.
Run your own audit →

Audit of fast-check

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
72.7% (8) staged or trusted
Any trust
81.8% (9) incl. provenance
No trust signal
18.2% (2) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/248/289/8
  1. ...
    9/11 any trust
  2. ...
    9/11 any trust
  3. ...
    9/11 any trust
  4. ...
    9/11 any trust
  5. ... [viewing]
    9/11 any trust
    3. [viewing]
  6. 9/11 any trust
  7. 9/11 any trust
  8. 9/11 any trust
  9. 9/11 any trust
  10. ...
    9/11 any trust
In scope
11
Staged publish
3
Trusted publisher
5
Provenance only
1
No trust signal
2
Deprecated latest
2
11 packages · click a column to sort
Package trust level report
pure-rand8.4.2staged publishGitHub Actions73,035,002—
fast-check4.9.0staged publishGitHub Actions36,611,939—
@fast-check/packaged0.7.1staged publishGitHub Actions69—
@fast-check/ava3.0.1trusted publisherGitHub Actions5,201—
@fast-check/vitest0.4.1trusted publisherGitHub Actions284,402—
@fast-check/poisoning0.3.0trusted publisherGitHub Actions365—
@fast-check/worker0.6.0trusted publisherGitHub Actions36—
@fast-check/jest2.2.0trusted publisherGitHub Actions340,881—
@fast-check/expect-type0.2.1provenancendubien109DEPRECATED
ava-fast-check6.0.0nonendubien53DEPRECATED
jsverify-to-fast-check0.0.3nonendubien12—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal