npm Stage-Only Tokens Add a Human Release Gate—but Remain Write Credentials
Cover: illustrative coding photograph, not a screenshot of npm staged publishing. Photo on Unsplash Miles Park IT engineer and technology analyst based in Virginia, covering enterprise AI architecture, agentic workflows, and cloud infrastructure. About the author 📌 Key Takeaways Separate submission from release: npm’s Read and write (stage only) token decouples automated candidate submission ( npm stage publish ) from public distribution, enforcing an interactive 2FA human maintainer gate. Keep protecting the token: The token is not a read-only or harmless upload key; it retains package-write capabilities including mutating dist-tags and deprecating active versions. Choose authentication and approval separately: Authentication method (OIDC trusted publishing vs long-lived secrets) and release authority (direct publish vs staging) must be evaluated and configured as separate governance controls. npm’s Read and write (stage only) gr...