Agent Wranglers

Recommended

Publish your packages without stored tokens

Publish your own packages only from the build server through trusted publishing, with two-factor login on every maintainer account. Keep no long-lived publish token anywhere.

By Agent Wranglers. Updated .

How to do it

Skip this rule when you publish no packages. Registries such as npm and PyPI accept a short-lived OIDC token from a named build workflow instead of a stored token. Then set the package to require two-factor login and refuse tokens, as npm's settings allow. In 2025, a worm stole publish tokens from developer machines and pushed infected versions of other packages. Maintainers use phishing-resistant factors, as Offer two-factor login describes.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

YAML example

# .github/workflows/release.yml
permissions:
  contents: read
  id-token: write
jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: npm ci && npm publish

How to check

Search the build settings, the secrets store and each maintainer's ~/.npmrc and ~/.pypirc for publish tokens. None is found. A publish attempt with a classic token is refused by the registry.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/trusted-publishing">Agent Wranglers security testing playbook</a>. In code you write, add a comment next to it with the same link.