{"record":{"id":"f9251869d12d82e2","repo":"nodejs/node","slug":"found-no-installed-dependencies-to-audit","errorCode":null,"errorMessage":"found no installed dependencies to audit","messagePattern":"found no installed dependencies to audit","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"deps/npm/lib/utils/verify-signatures.js","lineNumber":34,"sourceCode":"    this.keys = new Map()\n    this.invalid = []\n    this.missing = []\n    this.checkedPackages = new Set()\n    this.verified = []\n    this.auditedWithKeysCount = 0\n    this.verifiedSignatureCount = 0\n    this.verifiedAttestationCount = 0\n    this.exitCode = 0\n  }\n\n  async run () {\n    const start = process.hrtime.bigint()\n    const { default: pMap } = await import('p-map')\n\n    // Find all deps in tree\n    const { edges, registries } = this.getEdgesOut(this.tree.inventory.values(), this.filterSet)\n    if (edges.size === 0) {\n      throw new Error('found no installed dependencies to audit')\n    }\n\n    const tuf = await tufClient.initTUF({\n      cachePath: this.opts.tufCache,\n      retry: this.opts.retry,\n      timeout: this.opts.timeout,\n    })\n    await Promise.all([...registries].map(registry => this.setKeys({ registry, tuf })))\n\n    log.verbose('verifying registry signatures')\n    await pMap(edges, (e) => this.getVerifiedInfo(e), { concurrency: 20, stopOnError: true })\n\n    // Didn't find any dependencies that could be verified, e.g. only local deps, missing version, not on a registry etc.\n    if (!this.auditedWithKeysCount && !this.verifiedAttestationCount) {\n      throw new Error('found no dependencies to audit that were installed from ' +\n                      'a supported registry')\n    }\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/utils/verify-signatures.js#L16-L52","documentation":"Thrown by npm's signature verification (VerifySignatures.run) when getEdgesOut returns an empty edge set — i.e. the dependency tree has no outgoing dependency edges at all. With nothing installed to verify, the audit cannot proceed and aborts. Triggered by 'npm audit signatures' or install/run with verify-signatures enabled.","triggerScenarios":"Running `npm audit signatures` (or install with --audit-signatures / verify-signatures config) in a project whose node_modules tree has no dependencies: empty/absent dependencies & devDependencies, node_modules not installed, or a filterSet that excludes every edge.","commonSituations":"Freshly scaffolded package with no deps; running the command before `npm install`; running it outside a package directory; workspace/positional filters (--workspace, --include) that filter out all packages; a global install context with no tree.","solutions":["Run `npm install` first so node_modules and the tree are populated, then re-run the audit.","Confirm the package actually declares dependencies/devDependencies in package.json.","Run the command from the package root that owns the lockfile/node_modules.","If using --workspace or --omit filters, widen them so at least one installable dependency is in scope.","If the project genuinely has no deps, this error is expected — skip signature auditing for it."],"exampleFix":"// before: audit run on empty tree\nnpm audit signatures            // throws 'found no installed dependencies to audit'\n// after: install first, then audit\nnpm install\nnpm audit signatures","handlingStrategy":"validation","validationCode":"const { existsSync } = require('node:fs')\nconst pkg = require('./package.json')\nconst hasDeps = Object.keys(pkg.dependencies || {}).length + Object.keys(pkg.devDependencies || {}).length > 0\nif (!hasDeps || !existsSync('node_modules')) {\n  console.warn('skipping audit signatures: no installed deps')\n}","typeGuard":null,"tryCatchPattern":"try {\n  await audit.signatures()\n} catch (err) {\n  if (/found no installed dependencies to audit/.test(err.message)) {\n    console.log('nothing to audit — install deps first')\n  } else throw err\n}","preventionTips":["Run `npm install` before `npm audit signatures`.","Guard CI steps with a check that node_modules exists and package.json declares deps.","Skip the audit stage for dependency-free packages."],"tags":["npm","audit","signatures","supply-chain","dependencies"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}