Publish with OIDC and delete the npm token
A stolen publish token is how one compromised maintainer becomes four hundred packages. Trusted publishing mints a short-lived token for the workflow run, so there is nothing long-lived to steal.
permissions: { id-token: write }
- run: pnpm publish --provenanceNo NODE_AUTH_TOKEN. Then npm logout on your laptop and never put the line back in ~/.npmrc.
securitynpmci
Longer version: the post this came from.