npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of vitest, generated . This is a read-only snapshot.
Run your own audit →

Audit of vitest

Re-run this audit
Tracking daily next
Share to Bluesky

Progress over time

Strong trust
92.6% (25) staged or trusted
Any trust
92.6% (25) incl. provenance
No trust signal
7.4% (2) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%7/138/2410/1110/24
  1. 25/27 any trust
  2. 25/27 any trust
  3. ...
    25/27 any trust
  4. ...
    25/27 any trust
  5. ...
    25/27 any trust
  6. 25/27 any trust
  7. 25/27 any trust
  8. 25/27 any trust
  9. ...
    25/27 any trust
  10. ...
    25/27 any trust
  11. 25/27 any trust
  12. ... [viewing]
    25/27 any trust
    1. [viewing]
  13. 25/27 any trust
  14. 25/27 any trust
  15. 25/27 any trust
  16. 25/27 any trust
  17. 25/27 any trust
  18. ...
    25/27 any trust
  19. 25/27 any trust
  20. ...
    25/27 any trust
  21. ...
    25/27 any trust
  22. ...
    25/27 any trust
  23. 25/27 any trust
  24. 25/27 any trust
  25. ...
    25/27 any trust
  26. 25/27 any trust
  27. ...
    25/27 any trust
  28. 25/27 any trust
  29. 25/27 any trust
  30. 25/27 any trust
  31. 25/27 any trust
  32. 25/27 any trust
  33. 25/27 any trust
  34. ...
    25/27 any trust
  35. 21/23 any trust
In scope
27
Staged publish
20
Trusted publisher
5
Provenance only
0
No trust signal
2
Deprecated latest
1
27 packages · click a column to sort
Package trust level report
vitest5.0.3staged publishGitHub Actions124,515,890—
@vitest/utils5.0.3staged publishGitHub Actions136,819,338—
@vitest/pretty-format5.0.3staged publishGitHub Actions136,872,151—
@vitest/spy5.0.3staged publishGitHub Actions148,349,958—
@vitest/expect5.0.3staged publishGitHub Actions121,490,677—
@vitest/snapshot5.0.3staged publishGitHub Actions101,621,411—
@vitest/browser5.0.3staged publishGitHub Actions10,600,964—
@vitest/ui5.0.3staged publishGitHub Actions15,722,120—
@vitest/browser-preview5.0.3staged publishGitHub Actions2,342,938—
@vitest/browser-playwright5.0.3staged publishGitHub Actions9,044,208—
@vitest/coverage-v85.0.3staged publishGitHub Actions42,615,487—
@vitest/coverage-istanbul5.0.3staged publishGitHub Actions2,943,761—
@vitest/web-worker5.0.3staged publishGitHub Actions138,800—
@vitest/mocker5.0.3staged publishGitHub Actions122,198,519—
@vitest/istanbul-lib-source-maps1.0.2trusted publisherGitHub Actions453,706—
@vitest/istanbul-lib-report1.0.2trusted publisherGitHub Actions8,359,415—
@vitest/istanbul-lib-instrument1.0.2trusted publisherGitHub Actions551,897—
@vitest/istanbul-lib-coverage1.0.2trusted publisherGitHub Actions8,363,670—
@vitest/browser-webdriverio5.0.0staged publishGitHub Actions32,147—
vitest-browser-react2.3.0staged publishGitHub Actions1,707,800—
vitest-browser-vue3.1.0staged publishGitHub Actions216,632—
vitest-browser-svelte3.1.0staged publishGitHub Actions290,305—
@vitest/runner4.1.11staged publishGitHub Actions80,617,087—
@vitest/ws-client4.1.11staged publishGitHub Actions543—
@vitest/eslint-plugin1.6.27noneveritemm3,891,918—
vite-node6.0.0trusted publisherGitHub Actions41,134,124—
@vitest/coverage-c80.33.0noneoreanno165,463DEPRECATED

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal