Package provenance · npm (packages)
What share of packages on npm have no build-provenance attestation tying the artifact to its source?
84.68% of packages on npm (95% CI 81.78–87.2%), measured across 679 packages on 2026-08-09.
Measured every Sunday since 2026-08-01 — 5 observations to date. Last measured 2026-08-09.
How this is measured
Bulk npm metadata: attestations and signatures on the latest release.
Built entirely from public bulk feeds — no target is contacted. Aggregate-only. 95% Wilson confidence intervals. Population: the most-downloaded packages per ecosystem plus a native-build stratum, from public registry metadata. Snapshot: packages-top400.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
A signature proves the registry served what the publisher uploaded; only provenance links the artefact to the source commit and build that produced it. Without it, a compromised publisher account or build step is undetectable. ~85% lack provenance.
Limits of this measurement
npm only. PyPI is excluded rather than counted as unsigned, because its JSON API does not surface PEP 740 attestations — absence of evidence is not evidence of absence. The earlier framing (counting only unsigned) read 0% because npm signs everything; the real gap is build provenance, which is why signed_only is a failure state.
The same check, other segments
- packages with a native build step98.92%
- long-tail (packages)98.92%
- all packages84.68%
- top100m+ (packages)74.81%
- the most-downloaded packages74.75%