npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of sveltejs, generated . This is a read-only snapshot.
Run your own audit →

Audit of sveltejs

Re-run this audit
Tracking daily next

Progress over time

Strong trust
51.4% (19) staged or trusted
Any trust
59.5% (22) incl. provenance
No trust signal
40.5% (15) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/248/268/278/309/29/49/59/79/10
  1. ...
    22/37 any trust
  2. 0/0 any trust
  3. 22/37 any trust
  4. 22/37 any trust
  5. 21/37 any trust
  6. 0/0 any trust
  7. 21/37 any trust
  8. 21/37 any trust
  9. 0/0 any trust
  10. 21/37 any trust
  11. 21/37 any trust
  12. 21/37 any trust
  13. 0/0 any trust
  14. 0/0 any trust
  15. 21/37 any trust
  16. 0/0 any trust
  17. 0/0 any trust
  18. 21/37 any trust
  19. 21/37 any trust
  20. ...
    21/37 any trust
  21. 21/37 any trust
  22. 21/37 any trust
  23. 0/0 any trust
  24. 21/37 any trust
  25. ...
    20/36 any trust
  26. 20/36 any trust
  27. 0/0 any trust
  28. ... [viewing]
    20/36 any trust
    1. [viewing]
  29. 20/36 any trust
  30. 20/36 any trust
  31. 0/0 any trust
  32. 20/36 any trust
  33. 20/36 any trust
  34. 20/36 any trust
  35. 20/36 any trust
  36. 0/0 any trust
  37. 20/36 any trust
In scope
36
Staged publish
0
Trusted publisher
17
Provenance only
3
No trust signal
16
Deprecated latest
3
36 packages · click a column to sort
Package trust level report
@sveltejs/adapter-bun1.0.0-next.1nonesvelte-admin460
@sveltejs/kit2.70.3trusted publisherGitHub Actions2,673,726
@sveltejs/acorn-typescript1.0.13trusted publisherGitHub Actions4,605,001
@sveltejs/load-config0.2.3trusted publisherGitHub Actions1,597,197
@sveltejs/opencode0.1.14trusted publisherGitHub Actions1,262
@sveltejs/vite-plugin-svelte7.3.0trusted publisherGitHub Actions3,355,836
@sveltejs/mcp0.1.26trusted publisherGitHub Actions27,796
@sveltejs/eslint-config10.0.4trusted publisherGitHub Actions10,303
@sveltejs/sv-utils0.3.3trusted publisherGitHub Actions19,977
@sveltejs/adapter-node5.5.7trusted publisherGitHub Actions913,735
@sveltejs/enhanced-img0.11.0trusted publisherGitHub Actions57,649
@sveltejs/adapter-vercel6.3.4trusted publisherGitHub Actions289,796
@sveltejs/adapter-cloudflare7.2.9trusted publisherGitHub Actions229,975
@sveltejs/package2.5.8trusted publisherGitHub Actions305,775
@sveltejs/svelte-preview-install0.0.1nonesvelte-admin2
@sveltejs/adapter-netlify6.0.4trusted publisherGitHub Actions21,182
@sveltejs/adapter-auto7.0.1trusted publisherGitHub Actions709,403
@sveltejs/vite-plugin-svelte-inspector5.0.2trusted publisherGitHub Actions1,967,111
@sveltejs/adapter-static3.0.10trusted publisherGitHub Actions945,847
@sveltejs/amp1.1.5provenancesvelte-admin1,137
@sveltejs/adapter-cloudflare-workers2.9.0provenancesvelte-admin3,248DEPRECATED
@sveltejs/svelte-json-tree2.2.1provenancesvelte-admin1,423
@sveltejs/repl0.6.0nonesvelte-admin1,429
@sveltejs/site-kit5.2.2nonesvelte-admin4,561DEPRECATED
@sveltejs/adapter-begin1.0.0-next.15nonesvelte-admin53DEPRECATED
@sveltejs/svelte-repl0.4.1noneconduitry717
@sveltejs/pancake0.0.18nonerich_harris1,683
@sveltejs/svelte-scroller2.0.7nonerich_harris2,891
@sveltejs/snowpack-config1.0.0-next.0nonerich_harris33
@sveltejs/app-utils1.0.0-next.0nonerich_harris304
@sveltejs/app0.0.7nonerich_harris9
@sveltejs/gl0.0.37nonerich_harris55
@sveltejs/gateau0.0.2nonerich_harris5
@sveltejs/svelte-virtual-list3.0.1nonerich_harris38,686
@sveltejs/gestures0.0.1nonerich_harris1,218
@sveltejs/svelte-subdivide2.2.0nonerich_harris20