Agent WranglersOSS-15Recommended
Vet a person before giving them release or admin rights
Give release, admin or registry rights only after a written nomination that another maintainer approves. The nominee has at least 6 months of reviewed contributions to the project.
How to do it
Attackers have taken over packages by offering help to a tired maintainer and asking for publish rights. The event-stream package on npm was handed over this way in 2018, and the new owner added code to steal cryptocurrency. The xz backdoor in 2024 came after two years of patient contributions. Patience alone does not prove good faith. So a second maintainer still reviews their release and build changes, as Review build files and test data in every outside change says. Grant write rights before release rights, and release rights before admin. When you hand over a whole project, follow Archive a project you stop maintaining.
How to check
Each grant of admin, maintain or registry owner rights in the code host's audit log links a nomination issue. That issue has an approval from a maintainer other than the nominee and the person who granted the rights.
Sources
Related rules
- OSS-10 Review build files and test data in every outside change in Open source maintenance
- OSS-40 Archive a project you stop maintaining in Open source maintenance
- OSS-16 Take back rights from people who have gone quiet in Open source maintenance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/maintainers-and-governance/vet-new-maintainers">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.