Check P3 · provenance family · severity MEDIUM · automatic · one of the 12 npm and PyPI package checks
Maps to OWASP LLM03 No declared source repository is an evidence gap, not a technique: the check reports that there was nothing to compare the package with, not that anything was hidden.
The question this check asks: does this package say where its source lives? A package that declares no repository leaves nothing to compare it with: no maintainers to look at, no history, no manifest to check its name against.
A package with no declared source has nothing to be checked against. That is common and usually harmless — plenty of long-lived packages never filled the field in — but it is also the easiest shape for a throwaway package to take, because there is nothing for a reader to open. Until this roster existed, a package that declared no repository was allowed with a note: the repository was all RepoGates assessed, and there was none. Now the package has its own verdict either way, and this check says what the missing field means for it.
When the registry's record declares no repository at all — no repository field on npm, no project link or home page on PyPI — the row is pkg-no-source: a note at 0 points on an established package (first published 90 days ago or more), and MEDIUM and 5 points on a new one, reading “a new package that declares no source repository — nothing to check it against”. A MEDIUM is a REVIEW: a warning under the default profile, never a block on its own. A declared source on another host is not this check's case; P2 names it.
An honest new package whose author did not fill the field in. It is a REVIEW for its first ninety days and a note after. The finding says exactly what is missing, and adding a repository to the package's metadata is the fix for an author.
Whether the declared repository is the right one. That is P4's question. A source the registry record does not carry — a link on a project's home page, a repository named in a README — is not searched for. The package's code is not read.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else; a package named on the line (npm install express, pip install flask, npx, npm create) is judged by its own verdict under this roster, its declared repository riding along. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. A package added by editing package.json or requirements.txt and installed later is not a line the hook judges. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what npmjs.org and pypi.org publish about a package — its record, its release history, its declared repository — and never the package's code or what it installs after it. A registry other than those two (a --registry or --index-url on the line) is asked about, not assessed. A package the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
npm view NAME repository homepage
curl -s https://pypi.org/pypi/NAME/json | jq '.info | {project_urls, home_page}'Empty answers are what this check reads. Look for the source by hand before you install, and treat a package whose author gives none with the care that deserves.
Is a package with no repository blocked? No. On an established package the missing field is a note; on a package first published less than 90 days ago it is a medium finding, which is a REVIEW and a warning under the default profile, never a block on its own.
Why does age change the grade? Because a long-lived package has a history a reader can weigh even without a repository, and a new one has nothing. The 90-day line is the one every check on this roster uses for an established package.
Does RepoGates look for the source anywhere else? No. The check reads the registry's own record. A repository linked from a README or a home page is not searched for, and a source the check cannot see is not invented.
P2 Source repository · P6 Package age · V5 Source repository.
Add RepoGates to Chrome Pricing
Sources for this page: the rule and weights from the product's own roster and scoring tables.