This repository tracks OIDC, provenance, and staged publishing adoption across high-impact npm packages. The package list is sourced from wooorm/npm-high-impact.
The results are generated by checking the publishing metadata for each package and are saved in results.json.
The dashed vertical line and ▲ markers indicate days when the upstream
npm-high-impactpackage list was updated, which changes the set of packages being tracked and can cause discontinuities in the trend.
Generated time: 2026-10-01T00:38:46.455Z
Total packages: 17125
Compact tuples in results.json · Full data with version and author in full-results.json
Published via trusted publishing with a provenance attestation and staged publishing. This is currently the most secure way to publish.
Click to show first 500 of 2359 in total
Published via trusted publishing with a provenance attestation.
Click to show first 500 of 4037 in total
Published via OIDC but with provenance attestation disabled.
Click to show first 200 of 122 in total
Has a provenance attestation, but not published via OIDC.