Packages and modules
Securing your code
Verifying ECDSA registry signatures
Table of contents
To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI.
- Install npm CLI version v8.15.0 or later
- Install dependencies using
Verifying registry signatures
Registry signatures can be verified using the following
npm audit signatures
Example response if all installed versions have valid registry signatures:
audited 1640 packages in 2s1640 have verified registry signatures
Some packages are missing registry signatures
The CLI will error if packages don't have signatures and if the package registry supports signatures. This could mean an attacker might be trying to circumvent signature verification.
You can check if the registry supports signatures by requesting the public signing keys from
Example response if some versions have missing registry signatures:
audited 1640 packages in 2s1405 packages have verified registry signatures235 packages have missing registry signatures but the registry is providing signing keys:email@example.com (https://registry.npmjs.org/)...