npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of sveltejs, generated . This is a read-only snapshot.
Run your own audit →

Audit of sveltejs

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
51.4% (19) staged or trusted
Any trust
59.5% (22) incl. provenance
No trust signal
40.5% (15) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/249/29/99/199/2410/1010/18
  1. [viewing]
    22/37 any trust
  2. ...
    22/37 any trust
  3. 22/37 any trust
  4. ...
    22/37 any trust
  5. ...
    22/37 any trust
  6. 22/37 any trust
  7. 22/37 any trust
  8. 0/0 any trust
  9. ...
    22/37 any trust
  10. 22/37 any trust
  11. ...
    22/37 any trust
  12. ...
    22/37 any trust
  13. 0/0 any trust
  14. 22/37 any trust
  15. ...
    22/37 any trust
  16. ...
    22/37 any trust
  17. 22/37 any trust
  18. 0/0 any trust
  19. ...
    22/37 any trust
  20. ...
    22/37 any trust
  21. 22/37 any trust
  22. 22/37 any trust
  23. 22/37 any trust
  24. 0/0 any trust
  25. 0/0 any trust
  26. 22/37 any trust
  27. 22/37 any trust
  28. ...
    22/37 any trust
  29. 0/0 any trust
  30. 22/37 any trust
  31. 22/37 any trust
  32. 21/37 any trust
  33. 0/0 any trust
  34. 21/37 any trust
  35. 21/37 any trust
  36. 0/0 any trust
  37. 21/37 any trust
  38. 21/37 any trust
  39. 21/37 any trust
  40. 0/0 any trust
  41. 0/0 any trust
  42. 21/37 any trust
  43. 0/0 any trust
  44. 0/0 any trust
  45. 21/37 any trust
  46. 21/37 any trust
  47. ...
    21/37 any trust
  48. 21/37 any trust
  49. 21/37 any trust
  50. 0/0 any trust
  51. 21/37 any trust
  52. ...
    20/36 any trust
  53. 20/36 any trust
  54. 0/0 any trust
  55. ...
    20/36 any trust
  56. 20/36 any trust
  57. 20/36 any trust
  58. 0/0 any trust
  59. 20/36 any trust
  60. 20/36 any trust
  61. 20/36 any trust
  62. 20/36 any trust
  63. 0/0 any trust
  64. 20/36 any trust
In scope
37
Staged publish
0
Trusted publisher
19
Provenance only
3
No trust signal
15
Deprecated latest
4
37 packages · click a column to sort
Package trust level report
@sveltejs/kit3.1.0trusted publisherGitHub Actions2,003,290—
@sveltejs/adapter-vercel7.0.1trusted publisherGitHub Actions231,515—
@sveltejs/package3.0.1trusted publisherGitHub Actions166,452—
@sveltejs/adapter-cloudflare8.0.1trusted publisherGitHub Actions218,062—
@sveltejs/sv-utils1.0.2trusted publisherGitHub Actions27,458—
@sveltejs/adapter-netlify7.0.1trusted publisherGitHub Actions18,918—
@sveltejs/adapter-node6.0.0trusted publisherGitHub Actions718,410—
@sveltejs/adapter-auto8.0.0trusted publisherGitHub Actions415,884—
@sveltejs/enhanced-img1.0.0trusted publisherGitHub Actions43,667—
@sveltejs/adapter-bun1.0.0trusted publisherGitHub Actions11,359—
@sveltejs/adapter-static4.0.0trusted publisherGitHub Actions648,766—
@sveltejs/message-box1.1.3trusted publisherGitHub Actions1,662—
@sveltejs/vite-plugin-svelte7.3.1trusted publisherGitHub Actions2,646,892—
@sveltejs/opencode0.1.16trusted publisherGitHub Actions1,180—
@sveltejs/acorn-typescript1.0.13trusted publisherGitHub Actions3,551,798—
@sveltejs/load-config0.2.3trusted publisherGitHub Actions2,003,178—
@sveltejs/mcp0.1.26trusted publisherGitHub Actions15,100—
@sveltejs/eslint-config10.0.4trusted publisherGitHub Actions5,421—
@sveltejs/svelte-preview-install0.0.1nonesvelte-admin4—
@sveltejs/vite-plugin-svelte-inspector5.0.2trusted publisherGitHub Actions1,218,757—
@sveltejs/amp1.1.5provenancesvelte-admin65DEPRECATED
@sveltejs/adapter-cloudflare-workers2.9.0provenancesvelte-admin393DEPRECATED
@sveltejs/svelte-json-tree2.2.1provenancesvelte-admin1,288—
@sveltejs/repl0.6.0nonesvelte-admin803—
@sveltejs/site-kit5.2.2nonesvelte-admin2,583DEPRECATED
@sveltejs/adapter-begin1.0.0-next.15nonesvelte-admin2DEPRECATED
@sveltejs/svelte-repl0.4.1noneconduitry37—
@sveltejs/pancake0.0.18nonerich_harris740—
@sveltejs/svelte-scroller2.0.7nonerich_harris1,018—
@sveltejs/snowpack-config1.0.0-next.0nonerich_harris27—
@sveltejs/app-utils1.0.0-next.0nonerich_harris391—
@sveltejs/app0.0.7nonerich_harris7—
@sveltejs/gl0.0.37nonerich_harris41—
@sveltejs/gateau0.0.2nonerich_harris1—
@sveltejs/svelte-virtual-list3.0.1nonerich_harris23,258—
@sveltejs/gestures0.0.1nonerich_harris329—
@sveltejs/svelte-subdivide2.2.0nonerich_harris6—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal