A tracking site for npm package attestations, showing which of the top 500 most-downloaded npm packages have SLSA provenance statements.

Attestations are cryptographically signed, publicly verifiable statements about npm packages that prove:

• Where the package was built (source repository)
• How it was built (CI/CD environment)
• When it was published

They use Sigstore for keyless signing and are automatically generated when publishing from supported CI/CD platforms with trusted publishers or the --provenance flag.

• Are we PEP 740 yet? - Python attestation tracking
• Python Wheels - Package adoption tracking

This project is licensed under the MIT License - see the LICENSE file for details.