npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of vitest, generated . This is a read-only snapshot.
Run your own audit →

Audit of vitest

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
92.6% (25) staged or trusted
Any trust
92.6% (25) incl. provenance
No trust signal
7.4% (2) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%7/138/249/8
  1. 25/27 any trust
  2. ...
    25/27 any trust
  3. ...
    25/27 any trust
  4. 25/27 any trust
  5. 25/27 any trust
  6. ...
    25/27 any trust
  7. 25/27 any trust
  8. ...
    25/27 any trust
  9. 25/27 any trust
  10. 25/27 any trust
  11. 25/27 any trust
  12. 25/27 any trust
  13. 25/27 any trust
  14. 25/27 any trust
  15. ...
    25/27 any trust
  16. [viewing]
    21/23 any trust
In scope
23
Staged publish
18
Trusted publisher
3
Provenance only
0
No trust signal
2
Deprecated latest
1
23 packages · click a column to sort
Package trust level report
@vitest/eslint-plugin1.6.23noneveritemm2,684,191—
vitest-browser-svelte3.0.0staged publishGitHub Actions230,317—
@vitest/pretty-format4.1.10staged publishGitHub Actions98,243,712—
@vitest/spy4.1.10staged publishGitHub Actions93,416,699—
@vitest/utils4.1.10staged publishGitHub Actions99,975,937—
@vitest/mocker4.1.10staged publishGitHub Actions74,760,759—
@vitest/runner4.1.10staged publishGitHub Actions75,771,420—
@vitest/snapshot4.1.10staged publishGitHub Actions77,135,116—
@vitest/expect4.1.10staged publishGitHub Actions75,147,701—
@vitest/ws-client4.1.10staged publishGitHub Actions500—
@vitest/browser4.1.10staged publishGitHub Actions7,590,654—
vitest4.1.10staged publishGitHub Actions76,469,540—
@vitest/browser-playwright4.1.10staged publishGitHub Actions5,381,654—
@vitest/browser-preview4.1.10staged publishGitHub Actions662,542—
@vitest/browser-webdriverio4.1.10staged publishGitHub Actions26,822—
@vitest/coverage-istanbul4.1.10staged publishGitHub Actions1,866,690—
@vitest/coverage-v84.1.10staged publishGitHub Actions28,649,697—
@vitest/ui4.1.10staged publishGitHub Actions10,693,241—
@vitest/web-worker4.1.10staged publishGitHub Actions129,641—
vitest-browser-react2.2.0trusted publisherGitHub Actions1,217,152—
vite-node6.0.0trusted publisherGitHub Actions30,107,057—
vitest-browser-vue2.1.0trusted publisherGitHub Actions204,928—
@vitest/coverage-c80.33.0noneoreanno116,401DEPRECATED

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal