Boshen @boshen.github.io · Dec 2 What's the point of npm trusted publishing? Any first time publish requires a token, local `npm publish` saves a publishing token that never expire, which can do perma-damage if stolen. Chance of me getting fucked is increasing while I make this post. Who the fuck remembers to delete this shit?
32 likes 6 replies
Replies
We need to stop using the word “trusted” to mean “actually untrustworthy but we think we have it nailed down.”
does that matter? if someone can access the local token, couldn't they access your ssh keys, and anything else... MSFT is moving npm to PATs basically, with 2FA enforced for over a year now on accounts that publish popular modules
Publish via GitHub Actions. No local token saved.
Trusted publishing doesn’t help if classic tokens still exist. Kill long-lived tokens, force scoped+expiring creds, and make 2FA mandatory — otherwise the attack surface stays.
They are making local publishing require 2FA. So that’s the real auth gate after the first publish. Still, hamfisted rollout and major package providers can’t even move due to no bulk configuration allowed. (The definitely typed ecosystem for one.) We do need better, It might be new registry time.
I thought they're obsoleting all those never-expire tokens Dec 9. no?