Narrower credentials and public code browsing arrive on npm

npm maintainers and package consumers each get a new safeguard this week. Publishers can now issue granular access tokens that limit what a compromised credential can do, while the npm website gains a free code explorer that lets anyone inspect a package's contents before ever running npm install.

Least-privilege tokens for publishers

Until now, npm offered automation tokens that let the holder publish to any package the account could access. That broad blast radius made a stolen token especially dangerous, given that credential theft remains one of the leading causes of supply chain breaches. Granular access tokens close that gap by letting maintainers and org owners mint credentials scoped to a specific set of packages and scopes.

Org owners get a second benefit: these tokens can manage one or more organizations, along with their teams and members. Previously, org automation had to lean on publish tokens, which are designed for interactive CLI use and often conflict with 2FA requirements in scripted workflows. Granular tokens are built for unattended administration.

The new token type also supports two operational guardrails:

  • IP allow-lists that restrict which network ranges can use the token for npm API calls.
  • An expiration window of up to one year, encouraging regular rotation.

The rotation push is not incidental. Fewer than 10% of existing npm tokens are used regularly, leaving a large pool of long-lived credentials that are candidates for eventual compromise. Setting short, deliberate expiration dates and rotating tokens aggressively reduces the attack surface available to an adversary who obtains one.

Inspect packages before you install them

Consumers typically verify a package by downloading it and reading the source locally. That flow is straightforward, but not safe: the package might carry malicious code or install scripts that execute during installation. The new npm code explorer removes that hazard by rendering package contents directly on the npm portal, so you can scrutinize a package before deciding to adopt it.

The explorer was previously a paid perk for teams and Pro users; it is now public and free. It is rebuilt for better stability and speed, and works with nearly every package in the registry. Features include:

  • Syntax highlighting for .js, .ts, .md, .json, .css, and other commonly used languages and markup formats.
  • Viewing of any prior package version, not just the latest release.

The npm team has used the tool internally for several months to inspect packages flagged as malicious, and is inviting feedback in the npm feedback discussion.

2FA push reaches high-impact maintainers

The new features join an ongoing security enforcement push. Since November 1, 2022, npm has required two-factor authentication for all maintainers of high-impact packages, defined as those exceeding 1 million weekly downloads or more than 500 dependents. Those packages account for 93% of the roughly 200 billion monthly downloads on npm.

The mandate targets account hijacking, which remains the primary source of security incidents in the ecosystem. To lower the friction of mandatory 2FA, npm has improved the account recovery workflow and lets maintainers link GitHub and social media accounts to their npm profile as additional identity verification sources.