npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Tracked org sets

Latest daily package-trust snapshot for every tracked set.

18 sets
  1. astrojs Latest
    44/74 strong 48/74 any trust
    Next
    View latest →
  2. atcute Latest
    0/61 strong 0/61 any trust
    Next
    View latest →
  3. atproto Latest
    49/57 strong 49/57 any trust
    Next
    View latest →
  4. bluesky-social Latest
    0/34 strong 0/34 any trust
    Next
    View latest →
  5. cloudflare Latest
    60/328 strong 60/328 any trust
    Next
    View latest →
  6. fast-check Latest
    8/11 strong 9/11 any trust
    Next
    View latest →
  7. gameroman Latest
    15/133 strong 15/133 any trust
    Next
    View latest →
  8. gatsbyjs, netlify Latest
    20/393 strong 52/393 any trust
    Next
    View latest →
  9. lit Latest
    5/13 strong 9/13 any trust
    Next
    View latest →
  10. netlify Latest
    20/248 strong 52/248 any trust
    Next
    View latest →
  11. nuxt Latest
    51/155 strong 74/155 any trust
    Next
    View latest →
  12. preactjs Latest
    13/46 strong 13/46 any trust
    Next
    View latest →
  13. react-router, remix Latest
    8/14 strong 8/14 any trust
    Next
    View latest →
  14. sveltejs Latest
    19/37 strong 22/37 any trust
    Next
    View latest →
  15. testing-library Latest
    7/19 strong 7/19 any trust
    Next
    View latest →
  16. vercel Latest
    35/178 strong 38/178 any trust
    Next
    View latest →
  17. vitest Latest
    25/27 strong 25/27 any trust
    Next
    View latest →
  18. vue Latest
    33/115 strong 34/115 any trust
    Next
    View latest →

npm.report · No affiliation or endorsement by npm, Inc.

Made by Philippe Serhal