npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of gameroman, generated . This is a read-only snapshot.
Run your own audit →

Audit of gameroman

Re-run this audit
Tracking daily next

Progress over time

Strong trust
10.6% (15) staged or trusted
Any trust
10.6% (15) incl. provenance
No trust signal
89.4% (127) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/249/19/89/1910/410/22
  1. ...
    15/142 any trust
  2. 15/142 any trust
  3. ...
    15/142 any trust
  4. ...
    15/142 any trust
  5. 15/137 any trust
  6. ...
    15/137 any trust
  7. ...
    15/137 any trust
  8. ...
    15/137 any trust
  9. ...
    15/137 any trust
  10. ...
    15/137 any trust
  11. ...
    15/137 any trust
  12. ... [viewing]
    15/137 any trust
    1. [viewing]
  13. 15/137 any trust
  14. 15/137 any trust
  15. 15/135 any trust
  16. ...
    15/135 any trust
  17. 15/135 any trust
  18. 15/135 any trust
  19. 15/133 any trust
  20. ...
    15/133 any trust
  21. ...
    15/131 any trust
  22. 15/131 any trust
  23. 15/131 any trust
  24. 15/131 any trust
  25. 15/131 any trust
  26. ...
    15/131 any trust
  27. ...
    15/131 any trust
  28. 15/131 any trust
  29. 15/131 any trust
  30. ...
    15/131 any trust
  31. 15/128 any trust
  32. ...
    15/127 any trust
  33. 15/129 any trust
  34. 14/117 any trust
In scope
137
Staged publish
15
Trusted publisher
0
Provenance only
0
No trust signal
122
Deprecated latest
2
137 packages · click a column to sort
Package trust level report
modern-archiver0.0.0nonegameroman181—
modern-zip0.0.0nonegameroman183—
@archiver/archiver0.3.0nonegameroman5,500—
jsx-userscript0.0.0nonegameroman162—
userscript-jsx0.0.0nonegameroman159—
@gameroman/config0.3.0staged publishGitHub Actions2,208—
miniproc0.0.0nonegameroman20—
tiny-process0.0.0nonegameroman22—
@lichess/api0.2.0staged publishGitHub Actions69—
minizod0.2.1staged publishGitHub Actions102—
nanojszip0.0.0nonegameroman10—
jszip-xs0.0.0nonegameroman6—
zip-xs0.0.0nonegameroman13—
isoneof0.0.0nonegameroman9—
find-proc0.2.0staged publishGitHub Actions1,732,327—
userscript-plugin-astro0.0.0nonegameroman12—
userscript-plugin-vite0.0.0nonegameroman10—
userscript-plugin-rolldown0.0.0nonegameroman20—
plugin-rolldown-userscript0.0.0nonegameroman14—
plugin-vite-userscript0.0.0nonegameroman7—
plugin-astro-userscript0.0.0nonegameroman11—
astro-plugin-userscript0.0.0nonegameroman9—
scriptdown0.0.0nonegameroman7—
is-not-positive-and-not-zero0.0.0nonegameroman9—
is-not-positive-and-not-00.0.0nonegameroman10—
neoyaml0.2.0staged publishGitHub Actions818—
nacl.ts0.1.0staged publishGitHub Actions17—
@excel.js/exceljs0.15.0nonegameroman7,578—
@excel.js/archiver0.1.0nonegameroman7,539—
88x310.0.0nonegameroman15—
@excel.js/unzipper0.3.0nonegameroman7,515—
unzip-xs0.0.0nonegameroman12—
query-dns0.0.0nonegameroman12—
modern-traverse0.0.0nonegameroman13—
workers-deploy0.0.0nonegameroman8—
workers-cli0.0.0nonegameroman7—
cloudflare-deploy0.0.0nonegameroman9—
proc-find0.0.0nonegameroman9—
pawfs0.0.1staged publishGitHub Actions18—
savefile.js0.2.0staged publishGitHub Actions100—
genson.ts0.0.2staged publishGitHub Actions13—
oxlint-plugin-anti-slop0.0.0nonegameroman18—
@archiver/zip-stream0.1.1nonegameroman5,282—
@archiver/tar-stream0.1.1nonegameroman5,273—
@archiver/readdir-glob0.1.1nonegameroman5,120—
@excel.js/jszip0.2.0nonegameroman7,502—
es-pako0.1.0staged publishGitHub Actions2,285—
ged.ts0.0.0nonegameroman10—
@eslintplugin/eslint-plugin-react0.1.0nonegameroman12—
@eslintplugin/eslint-plugin-jsx-a11y0.1.0nonegameroman9—
@eslintplugin/jsx-ast-utils0.1.0nonegameroman9—
@eslintplugin/resolve0.1.0nonegameroman5—
nano-bplist-creator0.1.0nonegameroman13—
nano-stream-buffers0.1.0nonegameroman47—
kit-p0.0.2staged publishGitHub Actions11—
limit-p0.0.0nonegameroman7—
nanopass0.0.0nonegameroman12—
herdr-ts-sdk0.0.0nonegameroman9—
css-stop0.0.0nonegameroman6—
color-stop0.0.0nonegameroman5—
css-color-stop0.0.0nonegameroman8—
nanoyaml0.0.0nonegameroman7—
es-sax0.1.2staged publishGitHub Actions147—
picocalc0.0.4staged publishGitHub Actions71—
train-times0.0.4staged publishGitHub Actions36—
fft.ts0.1.2staged publishGitHub Actions67—
neotoml0.0.1nonegameroman54—
@neotoml/stringifier0.0.1nonegameroman47—
@neotoml/parser0.0.1nonegameroman43—
nanotoml0.0.0nonegameroman8—
tiny-toml0.0.0nonegameroman8—
is-system0.3.1nonegameroman26—
sys-is0.0.0nonegameroman11—
bigint.bitlength0.2.0nonegameroman72—
esm-ver0.0.0nonegameroman8—
es-ver0.0.0nonegameroman8—
@rolldown-plugin/solid0.1.0nonegameroman217—
number.clamp0.0.0nonegameroman6—
bigint.clamp0.0.0nonegameroman9—
bigint.sqrt0.0.0nonegameroman5—
number.prototype.clamp0.0.0nonegameroman9—
telefon0.0.0nonegameroman6—
infinibrowser0.9.1nonegameroman107—
alt-lineages0.0.0nonegameroman9—
infinite-craft0.1.0nonegameroman18—
@savefile/fixtures0.0.1nonegameroman28—
lineage-generator0.0.0nonegameroman8—
es-concat-stream0.1.0nonegameroman189—
roman0.5.0nonegameroman13—
nanoxml0.1.0nonegameroman21—
picoclone0.2.0nonegameroman11—
es-xml2js0.0.0nonegameroman7—
nanonum0.0.0nonegameroman3—
nanocalc0.0.0nonegameroman10—
@gameroman/empty0.0.0nonegameroman7—
whatbeatsrock0.0.5nonegameroman32—
mini-lazystream0.1.0nonegameroman8—
usts0.1.1nonegameroman152—
@infinite-craft/dom-types0.0.4nonegameroman149—
@stockfish/bun0.0.2nonegameroman3—
oxlint-next-config0.0.0nonegameroman7—
oxlint-config-nextjs0.0.0nonegameroman2—
@pretty-error/pretty-error0.2.0nonegameroman5—
nanoflight0.2.0nonegameroman11—
prettier-next0.0.0nonegameroman4—
websim0.1.0nonegameroman505—
@websimai/socket-types0.1.0nonegameroman20—
@websimai/client-api-types0.1.0nonegameroman22—
@websimai/shared-types0.1.0nonegameroman38—
@archiver/compress-commons0.0.7nonegameroman23DEPRECATED
@no-polyfill/string.prototype.matchall0.0.1nonegameroman5—
@no-polyfill/array-includes0.0.1nonegameroman7—
no-polyfill0.0.0nonegameroman7—
nano-stringify-object0.0.0nonegameroman6—
@nanotemp/quick-temp0.0.1nonegameroman6—
nanotemp0.0.1nonegameroman11—
fast-de0.0.0nonegameroman2—
smol-de0.0.0nonegameroman5—
nano-deep-equal0.0.0nonegameroman4—
shoojs0.0.0nonegameroman6—
ultramatch0.0.0nonegameroman4—
ultraglob0.0.0nonegameroman9—
lsdk0.0.0nonegameroman8—
deob0.0.0nonegameroman14—
@websimai/core-api-types0.0.5nonegameroman13DEPRECATED
biomejs0.0.0nonegameroman123—
stockfish-bun0.0.0nonegameroman8—
nldjson0.0.0nonegameroman6—
best-auth0.0.0nonegameroman7—
elysiajs0.0.0nonegameroman54—
lijs0.0.0nonegameroman5—
rmandotdev0.0.0nonegameroman7—
ts-pandoc0.0.1nonegameroman6—
gameroman0.0.1nonegameroman5—
internet-roadtrip0.0.1nonegameroman6—
infinite-craft-helper0.0.1nonegameroman6—
infinite-craft-framework0.0.1nonegameroman8—