npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of nuxt, generated . This is a read-only snapshot.
Run your own audit →

Audit of nuxt

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
0% (0) staged or trusted
Any trust
0% (0) incl. provenance
No trust signal
0% (0) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/98/248/319/810/610/1210/22
  1. [viewing]
    0/0 any trust
  2. 76/157 any trust
  3. ...
    76/157 any trust
  4. 76/157 any trust
  5. 76/157 any trust
  6. 76/156 any trust
  7. ...
    76/156 any trust
  8. ...
    74/155 any trust
  9. 74/155 any trust
  10. ...
    74/155 any trust
  11. ...
    74/155 any trust
  12. ...
    74/155 any trust
  13. ...
    74/155 any trust
  14. ...
    74/155 any trust
  15. ...
    74/155 any trust
  16. 74/155 any trust
  17. 74/154 any trust
  18. 74/154 any trust
  19. 74/154 any trust
  20. ...
    74/154 any trust
  21. ...
    74/154 any trust
  22. 74/154 any trust
  23. ...
    73/153 any trust
  24. ...
    73/152 any trust
  25. 73/152 any trust
  26. 73/152 any trust
  27. 73/152 any trust
  28. 73/152 any trust
  29. 73/152 any trust
  30. 73/152 any trust
  31. 73/152 any trust
  32. 73/152 any trust
  33. 73/152 any trust
  34. ...
    73/152 any trust
  35. 73/152 any trust
  36. 72/150 any trust
In scope
0
Staged publish
0
Trusted publisher
0
Provenance only
0
No trust signal
0
Deprecated latest
0
0 packages · click a column to sort
Package trust level report

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal