Recommended Free Tools
A package registry can establish a few concrete facts about a release: which account or authorized workflow published it, whether the files you download match what was published, and, where the publisher has opted in, where the code was built. It cannot establish that the package is safe. Trust in a software artifact is a chain of decisions that spans the maintainer’s account, the authority to publish, the build workflow, the package contents, and your own install policy. A signature or provenance record verifies one link in that chain.
Where trust sits inside a registry
Registries are part of the security boundary, not just file hosts. OpenSSF’s Principles for Package Repository Security groups registry controls into four capability tracks (authentication, authorization, general capabilities, and CLI tooling) and defines four maturity levels. Those levels are goals to assess. They do not mean every ecosystem has implemented every control.
As an Amazon Associate I earn from qualifying purchases.
Each link in the chain answers a different question, and none of them answers all of them:
| Link | What it can show | What it cannot show |
|---|---|---|
| Maintainer account | Whether sign-in uses phishing-resistant MFA and how account recovery works | Whether the person behind the account is trustworthy |
| Publishing authorization | Which account, token, or configured workflow was allowed to publish a version | Whether that version was reviewed or intended by the project |
| Build workflow | Which repository and workflow produced the package, where the platform supports provenance | Whether the workflow file or the source code was itself malicious |
| Package contents | Whether downloaded files match published integrity data such as hashes | Whether the contents are harmless |
| Your install policy | Which sources, versions, and checks your project accepts | Whether upstream packages you have not checked are safe |
What provenance actually proves
Provenance is traceability evidence. npm’s documentation on generating provenance statements describes provenance attestations as public links that tie a package to its source code and build instructions. It also says signed attestations are recorded in a public transparency ledger. That gives you something checkable: if a release claims to come from a specific repository and workflow, you can verify that claim against a public record instead of taking a README’s word for it.
#1 Best Overall
What a provenance record establishes
- The source repository and build instructions the publisher linked to the package.
- A registry-generated record of the publish event, which npm calls a publish attestation.
- Tamper-evidence: because signed entries sit in a public ledger, a later alteration is detectable.
What it does not establish
- That the source code is free of malicious or vulnerable code. npm states that provenance does not guarantee a package contains no malicious code.
- That the maintainer identity is trustworthy, or that the account was not compromised before the release was published.
- That the build system was benign. PyPI’s security model states that an attestation does not say whether malicious code was introduced before or during the build.
PyPI’s security model documentation puts the limit in one sentence: “An attestation will tell you where a PyPI package came from, but not whether you should trust it.”
Can a signature make a package trustworthy?
No. A signature answers who or what signed a file, under which identity. It does not answer whether you should run it. PyPI’s attestations use keyless, identity-based signing with OIDC and short-lived keys, and the security model explains the roles of Sigstore Fulcio and Rekor in that process. Removing long-lived signing keys from maintainers’ hands is a real improvement, but it moves the trust to identity and workflow controls. PyPI’s documentation says the approach depends on trust in those controls and tells maintainers to limit who can trigger publishing workflows.
In practice, a signed package is only as trustworthy as the workflow that could sign it. If many people can edit the publish workflow or trigger it from unprotected branches, the signature faithfully records a release path that should never have been available.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How do I know if an npm package is safe?
You cannot get a yes or no from the registry, and no single signal decides it. ENISA’s Technical Advisory for Secure Use of Package Managers, version 1.1 (March 2026), recommends combining several checks. What you can establish is a profile of the package and whether that profile fits your use. The signals to weigh:
- Provenance: Does the version carry a provenance attestation tying it to a repository and build? A valid record confirms traceability. It does not confirm the code is safe.
- Publisher and project: Is the publisher a known maintainer of the project, and does the linked repository match the package you intended?
- Engagement and release history: Is the project actively maintained, and does its release history look consistent with normal development rather than a sudden burst of new versions?
- Security policy and contacts: Does the project publish a security policy and a security contact you could report to?
- Known vulnerabilities: Are there advisories against the version you would install?
- Name: Look-alike and typo-squatted names are a known tactic, so compare the exact name against the project’s own documentation.
What to check before installing a dependency
Apply these steps to each new dependency, and to any version you upgrade to.
- Confirm the exact package name and publisher from the project’s own documentation or repository link, not from a search result or a copied install snippet.
- Work through the signals above: publisher, release history, maintenance, security policy, and known vulnerabilities.
- Check provenance where your ecosystem offers it, using the commands below.
- Install from the registry. ENISA advises avoiding direct GitHub or tarball installs because they bypass registry checks.
- Pin the version and record integrity data in a lockfile or hash list.
- Run vulnerability checks again on a schedule, not only when you first add the package.
- Where feasible, maintain an internal allowlist of approved packages. ENISA recommends this as a way to limit what a project can pull in.
npm projects
- Run
npm install <package>. npm records SHA-512 integrity hashes inpackage-lock.json. Commit that file. - Run
npm audit signaturesin the project directory to check registry signatures and, where present, provenance attestations for installed packages. A pass confirms the records check out. It does not judge the code. - Run
npm auditto check installed packages against known vulnerability advisories. - In CI, use
npm ci, which installs exactly what the lockfile specifies and fails ifpackage.jsonand the lockfile disagree.
Python projects
- Use
pip hash <file>to print the digest of a downloaded distribution file. - Pin every requirement with a
--hash=entry inrequirements.txt, then install withpip install --require-hashes -r requirements.txt. pip rejects any file whose hash does not match.
How to stop a compromised token from publishing a malicious release
A long-lived publish token stored in CI can publish from anywhere it is copied to. The most effective change is removing that token from the pipeline. Protection then has three layers: the publishing path, the account, and your response plan.
Replace stored tokens with trusted publishing
npm’s trusted publishing documentation describes how OpenID Connect (OIDC) authorizes a configured workflow to publish, so that publishing does not depend on a long-lived write token for that path. PyPI and RubyGems offer comparable trusted-publisher setups; OpenSSF’s Zach Steindler has pointed to them as a way to move long-lived secrets out of build pipelines.
This changes what an attacker has to steal. Instead of copying a token out of a pipeline, they have to alter the configured workflow or the repository it runs from. That makes the workflow and its repository the assets to protect.
Protect the account and the workflow
- Turn on two-factor authentication for every maintainer account, including the accounts that administer the repository.
- Restrict who can edit publish workflows, approve their runs, or trigger them from protected branches. PyPI’s documentation makes this a maintainer responsibility.
- Gate release jobs behind an approval step. In GitHub Actions, environment protection rules can require reviewers before a publish job runs.
- After trusted publishing works, remove the old stored tokens and confirm the registry no longer accepts them.
If a token or account is compromised
- Revoke the suspect token immediately. Manage tokens from your npm account’s access token settings, or run
npm token revoke <token>from a trusted machine. - Reset the account password, re-enroll MFA, and end other active sessions.
- List publish timestamps with
npm view <package> time --json, and identify every version published since the suspected window. - Compare those versions against your repository’s release commits. Check the repository for changes to publish workflows, new collaborators, and altered secrets or environment settings.
- Deprecate or remove suspicious versions, subject to the registry’s unpublish rules, then publish a clean release from a known-good commit.
- Tell downstream users which versions to avoid, and report the incident through the registry’s security channel.
Pinned lockfiles stop a new malicious release from installing automatically. They do not remove a malicious version that someone already installed, so review lockfile diffs during this response and rebuild from a version you have verified.
Where npm trusted publishing and provenance currently apply
These requirements come from npm’s documentation and change over time, so confirm them on the live trusted publishing page and the provenance page before you rely on them. The documented minimums are npm CLI 11.5.1 or later and Node.js 22.14.0 or later.
| CI platform | Trusted publishing supported | Automatic provenance from trusted publishing |
|---|---|---|
| GitHub Actions (GitHub-hosted runners) | Yes | Yes, when the source repository and package meet npm’s documented public repository and package conditions |
| GitLab CI/CD (GitLab.com shared runners) | Yes | Yes, under the same documented public conditions |
| CircleCI (cloud) | Yes | No; CircleCI trusted publishing does not currently include provenance attestations |
| Self-hosted runners | Not listed as supported in npm’s trusted publishing documentation | Not stated |
If your build runs on a self-hosted runner, you will need another way to publish, and the token-hardening steps above apply in full.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsComparing registries without a single score
Registries differ in whether they manage user accounts, build packages, or only host source code, so a single ranking hides more than it reveals. Use the table below to ask each registry the same questions and to compare only the controls that apply to its role.
| Dimension | What to ask | Evidence to look for |
|---|---|---|
| Identity and account security | Are phishing-resistant MFA options offered? What is the recovery path? Are change notifications sent? Are critical maintainers protected? | MFA documentation, recovery procedures, notification settings |
| Publishing authorization | Are roles and credentials scoped? Is short-lived OIDC or trusted publishing available? Can workflows be restricted? | Publishing access documentation, trusted publisher configuration |
| Artifact integrity and provenance | Are published versions immutable? Are hashes, signatures, or attestations published, and can consumers verify them? | Integrity metadata, attestation records, verification tooling |
| Namespace and package abuse | Is typo-squatting mitigated? Are suspicious packages reportable? Is malware scanning and vulnerability warning in place? Is there an incident response process? | Published policies and reporting channels |
| Transparency and consumer tooling | Are event logs available? Are advisories machine-readable? Does the client support lockfile or hash pinning, vulnerability checks, and SBOM generation? | Event logs, advisory feeds, client documentation |
OpenSSF’s 2024 guidance on programming language package repositories frames these as capabilities to assess rather than scores to assign. Treat a registry’s answer as valid only for the ecosystem, version, and date you checked.
How common is namespace verification?
OpenSSF’s 2023 report, Taking the Pulse of Leading Software Repositories’ Security, found that 45.5% of package managers surveyed did not require, and did not plan to require, DNS verification for namespace or domain-name attributes. The report says the survey drew on maintainers or reputable sources across 11 ecosystems. Treat that figure as a 2023 picture of policy in that survey, not a current measure of how many registries verify namespaces. DNS verification is one way a publisher can show that it controls the domain it claims, so check each registry’s current namespace rules directly.
Maintainer accounts and hardware keys
Steindler’s advice in OpenSSF’s July 2024 post starts with the account itself:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →“For starters, make sure you’re protecting your accounts with 2FA, look at things like trusted publishers from PyPI and RubyGems to get long-lived secrets out of your build pipelines, and make your npm package source code and build instructions more transparent by generating provenance statements.”
Zach Steindler, OpenSSF Technical Advisory Council member and co-chair of the Securing Software Repositories Working Group, OpenSSF, July 31, 2024.
For maintainers, a FIDO2 security key is a direct way to use phishing-resistant MFA, which OpenSSF includes in its maturity guidance. It works only if your registry and identity provider accept that key type. Register a second key or another recovery method so that losing one does not lock you out. A key protects sign-in to the account. It does not validate package contents, provenance, or a build workflow.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
