AuPM
Verify human audit status for npm dependencies and fund open-source supply chain security using signed attestations and automated micropayments.
AuPM is an npm-compatible registry and package verification ecosystem designed to bring human-verified security to open-source software supply chains. By generating cryptographically signed DSSE attestations for exact package versions and lockfiles, AuPM reveals whether verified auditors have reviewed the underlying tarballs before installation. Through integrated Model Context Protocol (MCP) tooling and drop-in CLI utilities, coding agents and developers can automatically inspect audit status, verify dependency integrity offline, and optionally route micropayments via x402 and Algorand USDC to reward security auditors and open-source maintainers.