A Gold package page is a one screen summary of a package: its version, a risk badge, a four item Gold checklist, a health grade, package details and its direct dependencies. Read the checklist and the vulnerability count first, then the health grade, then the details that may be blank.
The header block
At the top you see the package name, the ecosystem (cargo, npm and so on), the current version and, on some pages, a risk badge such as LOW. An install command for that exact version sits below it, with a copy button. Check that the version matches what you plan to install. Pages describe the version they scanned, not necessarily the one in your lockfile.
The stats row
The page shows weekly downloads, GitHub stars, dependency count and vulnerability count. Treat these as quick signals, not proof. A zero in any box can mean the value is truly zero or that the data was not available for that package. On the pages we reviewed, some counts looked implausible for well known projects, so cross check popularity on the registry itself.
Gold Verification
This is the section most people want. It lists four items: no high or critical vulnerabilities, license identified, verified provenance and malware free. Each has a short sentence under it, and an attestation label such as L0, described on the page as meeting the Gold bar from automated verification.
Read the sentence, not just the tick. The wording under an item can say more than the item title. For example, an item titled "License identified" may carry text saying the license was not identified in metadata. If the text and the mark disagree, believe the text and check the source yourself. There is a longer post on this at /resources/blog/what-gold-status-means-and-does-not-mean.
Package health
The health block shows a letter grade and, where available, a breakdown from the OpenSSF Scorecard. Scorecard gives each check a score from 0 to 10 and blends them into an aggregate, so a package can earn a good grade while scoring zero on one check such as fuzzing. If no Scorecard is published, the page falls back to a maintenance heuristic based on release activity and metadata, and says so.
Package information and dependencies
Here you find license, last updated, first published, size, maintainer and links to the registry, homepage and repository. Some fields can be empty. Empty means unknown, not safe. The dependency list shows direct dependencies only, so a package with zero listed dependencies may still be pulled in alongside others in your tree.
A reading order that works
- Vulnerability count and the first Gold item.
- Malware item and provenance sentence.
- License sentence, then confirm in the repository.
- Health grade and weakest Scorecard checks.
- Install line, to make sure you pin the version you reviewed.
Safeguard Gold pages are a starting point for that review. The same data feeds the free scan at gold.safeguard.sh/scan, which lets you check a whole manifest at once.
Quick check
Does a Gold mark mean a package is safe to use?
No. The page itself defines Gold as no known high or critical vulnerabilities at last scan. It says nothing about unknown flaws or how you use the package.
What should I do when a field is blank?
Treat it as unknown and check the registry or the source repository directly.
Sources
Last reviewed: 19 October 2026.
