npm audit tells you about known vulnerabilities. npm audit signatures asks a different question: are the packages in your node_modules the ones the registry signed, and which of them can prove where they were built? npm 12.2.0 was published on 30 September 2026, and the command is part of the CLI you already have.
What's affected
Anything you install from the public npm registry. The command verifies registry signatures on the tarballs, and it also verifies provenance attestations for packages that publish them. The official docs describe the goal as ensuring "the integrity of packages you download from the public npm registry."
What to do now
- Install your dependencies first. The command audits what is on disk and fails with "found no installed dependencies to audit" in an empty project.
- Run it:
npm audit signatures
Our run on a project with 23 packages printed:
audited 23 packages in 1s
23 packages have verified registry signatures
2 packages have verified attestations
(use --json --include-attestations to view attestation details)
- Read the two counts separately. All 23 had registry signatures. Only 2 had provenance attestations, because publishers must opt in to produce them.
- For machine processing, use the JSON form from the docs:
npm audit signatures --json --include-attestations
- Put the plain command in CI after
npm ci, so an invalid signature is caught before anything deploys. - Treat a missing attestation as information, not failure. It means the publisher has not enabled provenance.
Try it yourself
Run the command in one of your projects and note how many packages have attestations. Then look up one of the missing ones on npm and check whether its publisher could enable provenance.
Click through it at your own pace, or open it full screen.
Quick check
Does a verified attestation prove a package is safe?
No. It proves where and how the package was built, not that the code is free of bugs or malicious intent.
