nodejs/node · warning · Error

found no dependencies to audit that were installed from a su

Error message

found no dependencies to audit that were installed from a supported registry

What it means

Thrown by npm's VerifySignatures.run after the verification pass completes: if auditedWithKeysCount and verifiedAttestationCount are both zero, none of the installed dependencies came from a registry that npm has signing keys for. The audit ran but found nothing reportable (e.g. all deps are local, file:, git:, link:, missing a version, or from an unsupported/private registry).

Source

Thrown at deps/npm/lib/utils/verify-signatures.js:49

    // Find all deps in tree
    const { edges, registries } = this.getEdgesOut(this.tree.inventory.values(), this.filterSet)
    if (edges.size === 0) {
      throw new Error('found no installed dependencies to audit')
    }

    const tuf = await tufClient.initTUF({
      cachePath: this.opts.tufCache,
      retry: this.opts.retry,
      timeout: this.opts.timeout,
    })
    await Promise.all([...registries].map(registry => this.setKeys({ registry, tuf })))

    log.verbose('verifying registry signatures')
    await pMap(edges, (e) => this.getVerifiedInfo(e), { concurrency: 20, stopOnError: true })

    // Didn't find any dependencies that could be verified, e.g. only local deps, missing version, not on a registry etc.
    if (!this.auditedWithKeysCount && !this.verifiedAttestationCount) {
      throw new Error('found no dependencies to audit that were installed from ' +
                      'a supported registry')
    }

    const invalid = this.invalid.sort(sortAlphabetically)
    const missing = this.missing.sort(sortAlphabetically)

    const hasNoInvalidOrMissing = invalid.length === 0 && missing.length === 0

    if (!hasNoInvalidOrMissing) {
      process.exitCode = 1
    }

    if (this.npm.config.get('json')) {
      const result = { invalid, missing }
      if (this.npm.config.get('include-attestations')) {
        result.verified = this.verified
      }
      output.buffer(result)

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Confirm at least some dependencies are sourced from the public npm registry (https://registry.npmjs.org) which has signing keys.
2. If using a private registry, ensure it proxies/mirrors the public registry and preserves signature metadata, or configure the appropriate keys.
3. Check that package-lock.json entries have resolved URLs pointing at a supported registry.
4. Reinstall with `npm install --prefer-online` to refresh registry metadata/signatures.
5. If all deps are legitimately local, treat this as expected and disable the audit for that project.

Example fix

// before: private registry without keys
npm config set registry https://internal-npm.mirror/
npm audit signatures   // throws 'found no dependencies to audit ... supported registry'
// after: use a registry that preserves npm signatures
npm config set registry https://registry.npmjs.org
npm install --prefer-online
npm audit signatures

const lock = require('./package-lock.json')
const supported = Object.values(lock.packages || {}).some(p => p.resolved && /registry\.npmjs\.org/.test(p.resolved))
if (!supported) console.warn('no deps from a supported registry; audit will be a no-op')

try {
  await audit.signatures()
} catch (err) {
  if (/supported registry/.test(err.message)) {
    console.log('all deps are local/private; skipping signature audit')
  } else throw err
}

When it happens

Trigger: All installed dependencies are from non-registry sources (file:, git:, workspace links), or from a private/self-hosted registry whose signing keys are not configured in the TUF root, or the deps are missing a resolved version. Running `npm audit signatures` then hits this throw.

Common situations: Monorepo where every dep is a local workspace package; private corporate registry/mirror without sigstore keys; --registry pointed at a fork that strips signatures; packages installed via git+ssh URLs; legacy install with no signature metadata.

Related errors

• found no installed dependencies to audit
• Tag name must not be a valid SemVer range: ${defaultTag.trim
• The programmatic API was removed in npm v8.0.0
• `${baseKey}` is not a valid npm option
• The `${baseKey}` option is deprecated, and cannot be set in

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/42dff4703d43100f. Report an issue: GitHub.