@ajna-inc/npmvc

Supply-chain credential system for npm. Sign attestations when you publish, verify every dependency when you install.

Pure TypeScript. Zero native dependencies. Works everywhere npm runs.

Quick start — consumer

npm install -g @ajna-inc/npmvc
npmvc install-hook

Every npm install now verifies signatures, age, publisher continuity, lifecycle scripts, and audit credentials across your entire dep tree.

Quick start — publisher

npm install -g @ajna-inc/npmvc
npmvc init
npm pkg set scripts.prepack="npmvc attest"
npm pkg set files='["dist", ".npmvc"]' --json

Every npm publish now signs Provenance + SBOM + Lifecycle credentials.

What gets checked

• Signatures — DSSE envelopes verified against publisher DID (ed25519)
• Age — versions younger than minAge (default 7d) are flagged
• Publisher continuity — DID changes across versions trigger warnings
• Lifecycle scripts — postinstall flagged unless whitelisted
• Transitive deps — full lockfile tree (npm, pnpm, yarn)
• Audit credentials — third-party scanner verdicts (Socket, Snyk)
• Revocation — revoked credentials are flagged
• SBOM — CycloneDX SBOM signed and bundled

CI/CD

# GitHub Actions
- name: Attest
  env:
    NPMVC_KEY: ${{ secrets.NPMVC_KEY }}
  run: npmvc attest

Set NPMVC_KEY as a repository secret containing your ~/.npmvc/wallet/key.json.

Key management

npm install -g @ajna-inc/npmvc
npmvc wallet export --passphrase "..." > key.enc    # encrypted backup
npmvc wallet import --passphrase "..." --input key.enc  # restore
npmvc credential handover --package my-lib --to did🔑z6Mk...  # transfer

Registry

Sync attestations to npmvc.com for public verification:

npm install -g @ajna-inc/npmvc
npmvc register --name my-company --registry https://npmvc.com
npmvc attest --registry https://npmvc.com

Badge: ![npmvc](https://npmvc.com/api/badge/my-lib)

Commands

Policy

Edit npmvc-policy.json:

{
  "enforcement": "block",
  "minAge": "7d",
  "unattested": "warn",
  "publisherContinuity": {
    "required": true,
    "onUnauthorizedChange": "block",
    "pinned": { "express": "did🔑z6Mk..." }
  }
}

License

Apache-2.0