npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Tracked org sets

Latest daily package-trust snapshot for every tracked set.

18 sets
  1. astrojs Latest
    47/76 strong 51/76 any trust
    Next
    View latest →
  2. atcute Latest
    0/61 strong 0/61 any trust
    Next
    View latest →
  3. atproto Latest
    49/59 strong 49/59 any trust
    Next
    View latest →
  4. bluesky-social Latest
    0/34 strong 0/34 any trust
    Next
    View latest →
  5. cloudflare Latest
    67/337 strong 67/337 any trust
    Next
    View latest →
  6. fast-check Latest
    8/11 strong 9/11 any trust
    Next
    View latest →
  7. gameroman Latest
    16/144 strong 16/144 any trust
    Next
    View latest →
  8. gatsbyjs, netlify Latest
    22/397 strong 56/397 any trust
    Next
    View latest →
  9. lit Latest
    5/13 strong 9/13 any trust
    Next
    View latest →
  10. netlify Latest
    22/252 strong 56/252 any trust
    Next
    View latest →
  11. nuxt Latest
    53/157 strong 76/157 any trust
    Next
    View latest →
  12. preactjs Latest
    13/46 strong 13/46 any trust
    Next
    View latest →
  13. react-router, remix Latest
    8/14 strong 8/14 any trust
    Next
    View latest →
  14. sveltejs Latest
    19/37 strong 22/37 any trust
    Next
    View latest →
  15. testing-library Latest
    9/19 strong 9/19 any trust
    Next
    View latest →
  16. vercel Latest
    39/193 strong 41/193 any trust
    Next
    View latest →
  17. vitest Latest
    25/27 strong 25/27 any trust
    Next
    View latest →
  18. vue Latest
    34/117 strong 35/117 any trust
    Next
    View latest →

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal