NPM PROVENANCE CHECK · ONE READ-ONLY REQUEST PER PACKAGE
Which of your dependencies lack a provenance attestation?
Paste a package-lock.json, a package.json, or a plain list of package names, and see which ones were published with an npm provenance attestation -- trusted publishing (OIDC, no long-lived token to steal) or npm publish --provenance from a supported CI -- and which still rely on a classic publish token, the exact mechanism the 2025-2026 Shai-Hulud worm abused to compromise maintainer accounts and push malicious versions.
Your file is parsed in this browser and never uploaded. Checking a package makes one GET request, from your browser, to the public npm registry -- the same one npm install already talks to.
1. Paste a lockfile, package.json, or a plain list
2. Provenance by package
Package
Version checked
Provenance
Detail
Prefer a CLI, or want this in CI?
Same logic, zero dependencies, one file:
node cli.mjs package-lock.json
node cli.mjs package-lock.json --json
node cli.mjs package-lock.json --without-provenance-only
node cli.mjs package.json # unpinned: checks the latest published version
echo "vite\nleft-pad@1.3.0" | node cli.mjs - # freeform list on stdin
Get cli.mjs — Node 18+, nothing to install. Reads only the file you name; the only network calls are the per-package registry lookups.
Common questions
Why isn't npm audit signatures enough?
npm audit signatures reports provenance too, but only for the packages already installed in the project you currently have open, one project at a time, with no report you can hand to a teammate or wire into a dashboard across several repos. This tool works from a pasted lockfile, package.json, or plain list -- no install required -- and the CLI emits JSON for scripting. More: why this exists alongside npm audit signatures.
Does a package without provenance mean it's compromised?
No. Most published npm packages predate trusted publishing (general availability was July 2025) or their maintainer hasn't migrated yet -- popular, actively maintained packages show up with no provenance attestation too. The absence of provenance is a fact about how a version was published, not a verdict on whether it is safe.
Is my package-lock.json uploaded anywhere?
No. The file is parsed entirely in your browser. What does leave your browser is one read-only GET request per package name/version to registry.npmjs.org, the same public registry npm install already talks to.
What counts as a provenance attestation?
The registry's own per-version metadata carries a dist.attestations.provenance field when that version was published via trusted publishing or npm publish --provenance from a supported CI. This tool reports exactly that field.
How is this different from a supply-chain security platform like Socket?
Different layers. Socket watches a connected dependency graph and the public registries on an ongoing basis across dozens of risk categories. This tool answers one narrower, one-time question from a pasted lockfile or the CLI: does this exact package version carry the registry's own provenance field? See this checker vs. Socket.