nodejs/node · warning · Error

found no installed dependencies to audit

Error message

found no installed dependencies to audit

What it means

Thrown by npm's signature verification (VerifySignatures.run) when getEdgesOut returns an empty edge set — i.e. the dependency tree has no outgoing dependency edges at all. With nothing installed to verify, the audit cannot proceed and aborts. Triggered by 'npm audit signatures' or install/run with verify-signatures enabled.

Source

Thrown at deps/npm/lib/utils/verify-signatures.js:34

    this.keys = new Map()
    this.invalid = []
    this.missing = []
    this.checkedPackages = new Set()
    this.verified = []
    this.auditedWithKeysCount = 0
    this.verifiedSignatureCount = 0
    this.verifiedAttestationCount = 0
    this.exitCode = 0
  }

  async run () {
    const start = process.hrtime.bigint()
    const { default: pMap } = await import('p-map')

    // Find all deps in tree
    const { edges, registries } = this.getEdgesOut(this.tree.inventory.values(), this.filterSet)
    if (edges.size === 0) {
      throw new Error('found no installed dependencies to audit')
    }

    const tuf = await tufClient.initTUF({
      cachePath: this.opts.tufCache,
      retry: this.opts.retry,
      timeout: this.opts.timeout,
    })
    await Promise.all([...registries].map(registry => this.setKeys({ registry, tuf })))

    log.verbose('verifying registry signatures')
    await pMap(edges, (e) => this.getVerifiedInfo(e), { concurrency: 20, stopOnError: true })

    // Didn't find any dependencies that could be verified, e.g. only local deps, missing version, not on a registry etc.
    if (!this.auditedWithKeysCount && !this.verifiedAttestationCount) {
      throw new Error('found no dependencies to audit that were installed from ' +
                      'a supported registry')
    }

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Run `npm install` first so node_modules and the tree are populated, then re-run the audit.
2. Confirm the package actually declares dependencies/devDependencies in package.json.
3. Run the command from the package root that owns the lockfile/node_modules.
4. If using --workspace or --omit filters, widen them so at least one installable dependency is in scope.
5. If the project genuinely has no deps, this error is expected — skip signature auditing for it.

Example fix

// before: audit run on empty tree
npm audit signatures            // throws 'found no installed dependencies to audit'
// after: install first, then audit
npm install
npm audit signatures

const { existsSync } = require('node:fs')
const pkg = require('./package.json')
const hasDeps = Object.keys(pkg.dependencies || {}).length + Object.keys(pkg.devDependencies || {}).length > 0
if (!hasDeps || !existsSync('node_modules')) {
  console.warn('skipping audit signatures: no installed deps')
}

try {
  await audit.signatures()
} catch (err) {
  if (/found no installed dependencies to audit/.test(err.message)) {
    console.log('nothing to audit — install deps first')
  } else throw err
}

When it happens

Trigger: Running `npm audit signatures` (or install with --audit-signatures / verify-signatures config) in a project whose node_modules tree has no dependencies: empty/absent dependencies & devDependencies, node_modules not installed, or a filterSet that excludes every edge.

Common situations: Freshly scaffolded package with no deps; running the command before `npm install`; running it outside a package directory; workspace/positional filters (--workspace, --include) that filter out all packages; a global install context with no tree.

Related errors

• found no dependencies to audit that were installed from a su
• The programmatic API was removed in npm v8.0.0
• Install git and ensure it's in your PATH.
• No dependencies found matching ${args.join(', ')}
• ${argv[2]} not recognized

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/f9251869d12d82e2. Report an issue: GitHub.