You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit cd82361
Browse filesBrowse the repository at this point in the historyBrowse files
- Add details to search docs intro to brief about when a new package
will show up in search result.
- Split provenance information to a separate documentation.
---------
Co-authored-by: Leo Balter <301201+leobalter@users.noreply.github.com>
Co-authored-by: Chris Patterson <chrispat@github.com>
Copy file name to clipboardExpand all lines: content/packages-and-modules/getting-packages-from-the-registry/searching-for-and-choosing-packages-to-download.mdx
+3-55Lines changed: 3 additions & 55 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,8 @@ redirect_from:
6
6
7
7
You can use the npm search bar to find packages to use in your projects. The search is performed using content from the package's title, description, readme, and keywords and is powered by [opensearch](https://opensearch.org/). Search results are displayed based on keyword matching from the package's title, description, readme, and keywords. No subjective ranking criteria are applied, except for a minimal boost to deprioritize spammy or entirely new packages, aiming to maintain a neutral stance towards all other packages.
8
8
9
+
Please note that newly published packages may take up to two weeks to appear in the search results. Additionally, deprecated packages are excluded from the search results to enhance the user experience.
10
+
9
11
## Searching for a package
10
12
11
13
1. In the search bar, type a search term and press **Enter**. As you type, possible choices will appear.
@@ -22,58 +24,4 @@ You can use the npm search bar to find packages to use in your projects. The sea
22
24
23
25
## Package provenance
24
26
25
-
When packages have been published with provenance, you can:
26
-
27
-
- Verify where and how a package was published.
28
-
- Validate that an authorized user published a package.
29
-
30
-
You can use this information to audit packages and determine whether or not you want to consume them. For more information about npm provenance, see "[About npm provenance][about-provenance]."
31
-
32
-
To view provenance information for a package in the npm registry:
33
-
34
-
1. In the npm registry, navigate to a package.
35
-
36
-
2. On the package's page, in the **Version** field to the right of the README, look for a green check mark. If there is a green check mark, this means the package was published with provenance.
37
-
38
-
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance-check-mark.png"alt="Screenshot showing a Version field with a green check mark" />
39
-
40
-
3. Click on the check mark, then click **View more details**.
41
-
42
-
4. View the following information for the package:
43
-
44
-
-**Build Environment**: The environment used to build the package.
45
-
-**Build Summary**: A link to the workflow run that built the package.
46
-
-**Source Commit**: A link to the commit the package was built from.
47
-
-**Build File**: A link to the workflow file used to build the package.
48
-
-**Public Ledger**: A link to a transparency log entry attesting an authorized user published the package.
49
-
50
-
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance.png"alt="Screenshot showing npm provenance information for a published package" />
51
-
52
-
<Note>
53
-
54
-
**Note:** Whenever you access a package's provenance information on [npmjs.com](https://npmjs.com), the linked source commit and repository are checked by npm. If the linked source commit or repository cannot be found, an error message will appear at the top of the page and alongside the provenance information. This is to inform you that the provenance for this package can no longer be established, which may occur when a repository is deleted or made private.
55
-
56
-
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png"alt="Screenshot showing a warning when the provenance source commit or repository cannot be found." />
57
-
58
-
</Note>
59
-
60
-
### Verifying provenance attestations
61
-
62
-
When you download a package from the registry, you can verify the provenance of a package with the following CLI command:
63
-
64
-
```
65
-
npm audit signatures
66
-
```
67
-
68
-
This command checks the registry signatures and provenance attestations. If a package has missing or invalid signatures or attestations, it returns an error. This could indicate that a package has been tampered with.
69
-
70
-
<Note>
71
-
72
-
**Note:** In order to run the audit command to verify package provenance, you must:
73
-
74
-
- Install npm CLI version `v9.5.0` or later: `npm install -g npm@latest`
75
-
- Install dependencies with `npm install` or `npm ci`
The package homepage also displays provenance information when available. For details on how to verify this information, check [viewing package provenance](/viewing-package-provenance).
When packages have been published with provenance, you can:
8
+
9
+
- Verify where and how a package was published.
10
+
- Validate that an authorized user published a package.
11
+
12
+
You can use this information to audit packages and determine whether or not you want to consume them. For more information about npm provenance, see "[About npm provenance][about-provenance]."
13
+
14
+
To view provenance information for a package in the npm registry:
15
+
16
+
1. In the npm registry, navigate to a package.
17
+
18
+
2. On the package's page, in the **Version** field to the right of the README, look for a green check mark. If there is a green check mark, this means the package was published with provenance.
19
+
20
+
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance-check-mark.png"alt="Screenshot showing a Version field with a green check mark" />
21
+
22
+
3. Click on the check mark, then click **View more details**.
23
+
24
+
4. View the following information for the package:
25
+
26
+
-**Build Environment**: The environment used to build the package.
27
+
-**Build Summary**: A link to the workflow run that built the package.
28
+
-**Source Commit**: A link to the commit the package was built from.
29
+
-**Build File**: A link to the workflow file used to build the package.
30
+
-**Public Ledger**: A link to a transparency log entry attesting an authorized user published the package.
31
+
32
+
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance.png"alt="Screenshot showing npm provenance information for a published package" />
33
+
34
+
<Note>
35
+
36
+
**Note:** Whenever you access a package's provenance information on [npmjs.com](https://npmjs.com), the linked source commit and repository are checked by npm. If the linked source commit or repository cannot be found, an error message will appear at the top of the page and alongside the provenance information. This is to inform you that the provenance for this package can no longer be established, which may occur when a repository is deleted or made private.
37
+
38
+
<Screenshotsrc="/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png"alt="Screenshot showing a warning when the provenance source commit or repository cannot be found." />
39
+
40
+
</Note>
41
+
42
+
### Verifying provenance attestations
43
+
44
+
When you download a package from the registry, you can verify the provenance of a package with the following CLI command:
45
+
46
+
```
47
+
npm audit signatures
48
+
```
49
+
50
+
This command checks the registry signatures and provenance attestations. If a package has missing or invalid signatures or attestations, it returns an error. This could indicate that a package has been tampered with.
51
+
52
+
<Note>
53
+
54
+
**Note:** In order to run the audit command to verify package provenance, you must:
55
+
56
+
- Install npm CLI version `v9.5.0` or later: `npm install -g npm@latest`
57
+
- Install dependencies with `npm install` or `npm ci`
0 commit comments