{"record":{"id":"42dff4703d43100f","repo":"nodejs/node","slug":"found-no-dependencies-to-audit-that-were-installed","errorCode":null,"errorMessage":"found no dependencies to audit that were installed from a supported registry","messagePattern":"found no dependencies to audit that were installed from a supported registry","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"deps/npm/lib/utils/verify-signatures.js","lineNumber":49,"sourceCode":"    // Find all deps in tree\n    const { edges, registries } = this.getEdgesOut(this.tree.inventory.values(), this.filterSet)\n    if (edges.size === 0) {\n      throw new Error('found no installed dependencies to audit')\n    }\n\n    const tuf = await tufClient.initTUF({\n      cachePath: this.opts.tufCache,\n      retry: this.opts.retry,\n      timeout: this.opts.timeout,\n    })\n    await Promise.all([...registries].map(registry => this.setKeys({ registry, tuf })))\n\n    log.verbose('verifying registry signatures')\n    await pMap(edges, (e) => this.getVerifiedInfo(e), { concurrency: 20, stopOnError: true })\n\n    // Didn't find any dependencies that could be verified, e.g. only local deps, missing version, not on a registry etc.\n    if (!this.auditedWithKeysCount && !this.verifiedAttestationCount) {\n      throw new Error('found no dependencies to audit that were installed from ' +\n                      'a supported registry')\n    }\n\n    const invalid = this.invalid.sort(sortAlphabetically)\n    const missing = this.missing.sort(sortAlphabetically)\n\n    const hasNoInvalidOrMissing = invalid.length === 0 && missing.length === 0\n\n    if (!hasNoInvalidOrMissing) {\n      process.exitCode = 1\n    }\n\n    if (this.npm.config.get('json')) {\n      const result = { invalid, missing }\n      if (this.npm.config.get('include-attestations')) {\n        result.verified = this.verified\n      }\n      output.buffer(result)","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/utils/verify-signatures.js#L31-L67","documentation":"Thrown by npm's VerifySignatures.run after the verification pass completes: if auditedWithKeysCount and verifiedAttestationCount are both zero, none of the installed dependencies came from a registry that npm has signing keys for. The audit ran but found nothing reportable (e.g. all deps are local, file:, git:, link:, missing a version, or from an unsupported/private registry).","triggerScenarios":"All installed dependencies are from non-registry sources (file:, git:, workspace links), or from a private/self-hosted registry whose signing keys are not configured in the TUF root, or the deps are missing a resolved version. Running `npm audit signatures` then hits this throw.","commonSituations":"Monorepo where every dep is a local workspace package; private corporate registry/mirror without sigstore keys; --registry pointed at a fork that strips signatures; packages installed via git+ssh URLs; legacy install with no signature metadata.","solutions":["Confirm at least some dependencies are sourced from the public npm registry (https://registry.npmjs.org) which has signing keys.","If using a private registry, ensure it proxies/mirrors the public registry and preserves signature metadata, or configure the appropriate keys.","Check that package-lock.json entries have resolved URLs pointing at a supported registry.","Reinstall with `npm install --prefer-online` to refresh registry metadata/signatures.","If all deps are legitimately local, treat this as expected and disable the audit for that project."],"exampleFix":"// before: private registry without keys\nnpm config set registry https://internal-npm.mirror/\nnpm audit signatures   // throws 'found no dependencies to audit ... supported registry'\n// after: use a registry that preserves npm signatures\nnpm config set registry https://registry.npmjs.org\nnpm install --prefer-online\nnpm audit signatures","handlingStrategy":"validation","validationCode":"const lock = require('./package-lock.json')\nconst supported = Object.values(lock.packages || {}).some(p => p.resolved && /registry\\.npmjs\\.org/.test(p.resolved))\nif (!supported) console.warn('no deps from a supported registry; audit will be a no-op')","typeGuard":null,"tryCatchPattern":"try {\n  await audit.signatures()\n} catch (err) {\n  if (/supported registry/.test(err.message)) {\n    console.log('all deps are local/private; skipping signature audit')\n  } else throw err\n}","preventionTips":["Ensure at least some deps resolve from the public npm registry.","Verify package-lock.json entries have resolved URLs on a supported registry.","Reinstall with --prefer-online after switching registries.","Document that pure-local monorepos will trigger this error by design."],"tags":["npm","audit","signatures","supply-chain","registry","config"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}