Skip to content

.tip

· one of the small things

Publish with OIDC and delete the npm token

A stolen publish token is how one compromised maintainer turns into four hundred packages. Trusted publishing mints a short-lived token for each workflow run, so there's nothing long-lived to steal.

permissions: { id-token: write }
- run: pnpm publish --provenance

There's no NODE_AUTH_TOKEN. Then run npm logout on your laptop and never put that line back in ~/.npmrc.

securitynpmci

Longer version: the post this came from.