Consider Adopting NPM Trusted Publishing

Open
#2,665 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
javascript
Domain
ci-cd, release, security

Research direction

The issue names no repository files, workflows, or tests. Start by reading the linked npm trusted publishing and provenance documentation, then inspect the project’s package publishing process; done would require a decided and verified project-specific adoption plan.

Written by the indexing model from the issue text.

Description

Overview

Recent supply chain attacks on npm have highlighted the need for stronger package publishing security. The September 2025 Shai-Hulud worm compromised 500+ packages through stolen maintainer tokens, showing the risks of token-based publishing.

Trusted publishing helps by eliminating long-lived tokens that can be stolen or accidentally exposed; generating automatic provenance provides cryptographic proof of where/how packages are built; and is an industry standard adopted by PyPI, RubyGems, crates.io, NuGet, etc...

NPM is planning to deprecate legacy tokens and make trusted publishing the preferred method.

If assistance is welcome, please let me know and I can assist and/or get
further assistance as needed.

Reference

References:

Dominant language
JavaScript
Stars
9.8k
Forks
809
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sinonjs/sinon

All issues in sinonjs/sinon

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.