deprecate-totp-2fa
@reggi/path-to-regexp
dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2
dependabot/npm_and_yarn/main/eslint-10.4.0
dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0
dependabot/npm_and_yarn/main/proc-log-7.0.0
dependabot/npm_and_yarn/npm_and_yarn-826852524d
dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2
deprecate-totp-2fa
dhei/classic-tokens
gat-bypass-2fa-docs
jpg619/fix-accessibility-content-flow
jpg619/version-bump-tar-2
kartykp/gat-bypass-2fa-docs
kartykp/upgrade-path-to-regex
main
maitxn/version-bump-tar
patch-1
reggi/cache-based-on-version
reggi/dev-engines
reggi/fix-transform-prettier
reggi/overrides
update-search-sensitivity
| 1 | --- |
| 2 | title: Verifying ECDSA registry signatures |
| 3 | --- |
| 4 | |
| 5 | To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI. |
| 6 | |
| 7 | ## Prerequisites |
| 8 | |
| 9 | 1. Install npm CLI version v8.15.0 or later |
| 10 | 2. Install dependencies using `npm install` or `npm ci` |
| 11 | |
| 12 | ## Verifying registry signatures |
| 13 | |
| 14 | Registry signatures can be verified using the following `audit` command: |
| 15 | |
| 16 | ``` |
| 17 | npm audit signatures |
| 18 | ``` |
| 19 | |
| 20 | Example response if all installed versions have valid registry signatures: |
| 21 | |
| 22 | ``` |
| 23 | audited 1640 packages in 2s |
| 24 | |
| 25 | 1640 have verified registry signatures |
| 26 | ``` |
| 27 | |
| 28 | ## Troubleshooting |
| 29 | |
| 30 | ### Some packages are missing registry signatures |
| 31 | |
| 32 | The CLI will error if packages don't have signatures _and_ if the package registry supports signatures. This could mean an attacker might be trying to circumvent signature verification. You can check if the registry supports signatures by requesting the public signing keys from `registry-host.tld/-/npm/v1/keys`. |
| 33 | |
| 34 | Example response if some versions have missing registry signatures: |
| 35 | |
| 36 | ``` |
| 37 | audited 1640 packages in 2s |
| 38 | |
| 39 | 1405 packages have verified registry signatures |
| 40 | |
| 41 | 235 packages have missing registry signatures but the registry is providing signing keys: |
| 42 | |
| 43 | missing-dep@1.0.0 (https://registry.npmjs.org/) |
| 44 | ... |
| 45 | ``` |