npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of testing-library, generated . This is a read-only snapshot.
Run your own audit →

Audit of testing-library

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
47.4% (9) staged or trusted
Any trust
47.4% (9) incl. provenance
No trust signal
52.6% (10) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/259/1310/20
  1. 9/19 any trust
  2. 8/19 any trust
  3. 8/19 any trust
  4. [viewing]
    8/19 any trust
  5. 8/19 any trust
  6. 8/19 any trust
  7. 8/19 any trust
  8. ...
    8/19 any trust
  9. 8/19 any trust
  10. ...
    8/19 any trust
  11. 8/19 any trust
  12. 8/19 any trust
  13. ...
    8/19 any trust
  14. ...
    8/19 any trust
  15. ...
    8/19 any trust
  16. 8/19 any trust
  17. ...
    8/19 any trust
  18. 8/19 any trust
  19. 8/19 any trust
  20. 8/19 any trust
  21. 8/19 any trust
  22. 8/19 any trust
  23. ...
    8/19 any trust
  24. ...
    7/19 any trust
  25. ...
    7/19 any trust
  26. 7/19 any trust
  27. 7/19 any trust
  28. ...
    7/19 any trust
  29. ...
    7/19 any trust
  30. ...
    7/19 any trust
  31. 7/19 any trust
  32. ...
    7/19 any trust
  33. ...
    7/19 any trust
  34. ...
    7/19 any trust
  35. 7/19 any trust
  36. 7/19 any trust
  37. 7/19 any trust
  38. 7/19 any trust
  39. 7/19 any trust
In scope
19
Staged publish
0
Trusted publisher
8
Provenance only
0
No trust signal
11
Deprecated latest
1
19 packages · click a column to sort
Package trust level report
@testing-library/angular19.6.0trusted publisherGitHub Actions162,046—
@testing-library/user-event14.6.8trusted publisherGitHub Actions34,077,504—
@testing-library/react-native14.1.0nonemdjastrzebski2,651,296—
@testing-library/dom10.4.2trusted publisherGitHub Actions50,111,879—
@testing-library/react16.3.3trusted publisherGitHub Actions41,631,198—
@testing-library/jest-dom7.0.1trusted publisherGitHub Actions42,671,247—
@testing-library/svelte5.4.2trusted publisherGitHub Actions595,228—
@testing-library/svelte-core1.1.3trusted publisherGitHub Actions652,697—
@testing-library/cypress10.1.3trusted publisherGitHub Actions598,215—
@testing-library/react-render-stream2.0.2nonetesting-library-bot5,376—
@testing-library/preact3.2.4nonetesting-library-bot183,285—
@testing-library/vue8.1.0nonetesting-library-bot445,767—
@testing-library/testcafe5.0.1nonetesting-library-bot43,195—
@testing-library/jest-native5.4.3nonetesting-library-bot386,761DEPRECATED
@testing-library/jasmine-dom1.3.3nonetesting-library-bot8,927—
@testing-library/webdriverio3.2.1nonetesting-library-bot9,821—
@testing-library/react-hooks8.0.1nonetesting-library-bot1,167,858—
@testing-library/preact-hooks1.1.0nonecmckinstry6,003—
@testing-library/nightwatch2.0.0nonebenmonro17—

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal