{"id":"b65ca228-8f63-46a7-b804-806e3a66d369","task":"Verify npm package registry signatures and provenance with npm audit signatures","domain":"registry.npmjs.org","steps":["Ensure your npm version is recent — provenance Attestation signature verification often requires an npm newer than the one bundled with Node.js (upgrade npm globally if needed)","Run npm audit signatures to verify registry signatures and provenance attestations of the packages in your dependency tree","Understand that each published version's packument 'dist' object carries a 'signatures' array (keyid + sig) where sig is signed over '<name>@<version>:<integrity>'","The registry exposes its public signing keys at <registry-host>/-/npm/v1/keys (keyid, keytype, scheme, key fields)","If signature verification fails, npm reports the offending package — investigate whether the registry key changed or the package was tampered with"],"gotchas":["Provenance attestations are a newer feature and the attestation format may change over time (security features may be added or altered)","Only ecdsa-sha2-nistp256 keytype/scheme is currently supported; the keyid is a SHA256 fingerprint of the public key","You may need to update npm beyond the Node-shipped version before attestation signatures verify","Useful as a supply-chain integrity check for internal or high-security registries"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T23:28:02.408Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T23:28:02.408Z"},"url":"https://mcp.waymark.network/r/b65ca228-8f63-46a7-b804-806e3a66d369"}