1 package has an invalid registry signature:

Plural form: "N packages have invalid registry signatures:". A signature whose `keyid` is not among the registry's keys fails with code `EMISSINGSIGNATUREKEY` ("…has a registry signature with keyid: … but no corresponding public key can be found"); invalid provenance attestations are listed under "…has an invalid attestation".

npm audit signatures (npm 9.5+) — registry signature check of installed packages

What it means

npm downloaded the registry's public signing keys and checked each installed package's registry signature — an ECDSA signature over `name@version:integrity` — and for at least one package it did not verify. Either the package metadata (including the integrity hash of the tarball) changed after the registry signed it, or the registry you installed from signs with keys it does not publish. npm lists the affected packages and ends with "Someone might have tampered with this package since it was published on the registry!".

Why it happens

• A mirror or proxy registry serves different metadata

  common

  Private mirrors (Verdaccio, Artifactory, Nexus) that rewrite tarball URLs or re-pack packages but keep the original signatures — or sign with their own key without publishing it at `/-/npm/v1/keys`.

• Package metadata or content was changed

  occasional

  The integrity hash or tarball differs from what the registry signed. Treat the package as compromised until proven otherwise.

• Keys fetched from somewhere else

  occasional

  With a custom registry, npm fetches keys from that registry. If it returns the public registry's keys while serving re-signed metadata (or the reverse), verification fails.

How to fix it

1. 1.

   Compare with the public registry

   If the public registry's integrity for the same version matches your lockfile, the mirror is the problem; if not, the lockfile or the package was changed.

   # Same version, straight from the public registry: does the integrity match your lockfile?
   npm view left-pad-lite@1.0.0 dist.integrity --registry https://registry.npmjs.org/
   grep -A3 '"node_modules/left-pad-lite"' package-lock.json | grep integrity

2. 2.

   Run the check in CI

   `npm audit signatures` after `npm ci` makes the build fail on unsigned, wrongly signed or provenance-mismatched dependencies.

   # CI: fail the build on missing or invalid signatures and provenance
   - run: npm ci
   - run: npm audit signatures

← Browse the full signature error database