---
title: "No more tokens! Locking down npm Publish Workflows—zachleat.com"
url: https://daily.dev/posts/no-more-tokens-locking-down-npm-publish-workflows-zachleat-com-5csi2gg7j
source_url: https://www.zachleat.com/web/npm-security/
type: article
source: "Zach Leatherman"
published: 2025-12-04T04:13:43.984Z
updated: 2025-12-04T04:14:06.281Z
tags: ["security", "devops", "github-actions", "npm", "supply-chain"]
reading_time: 7
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# No more tokens! Locking down npm Publish Workflows—zachleat.com

**[Zach Leatherman](https://daily.dev/sources/zachleat)** · 7 min read · 0 upvotes · 0 comments

## Summary

Comprehensive guide to securing npm package publishing workflows in response to recent supply chain attacks. Covers eliminating access tokens in favor of OIDC Trusted Publishers, implementing 2FA requirements, using password managers, pinning GitHub Actions dependencies, checking in lock files, and restricting publishing access. Includes detailed security checklist with specific configuration steps for GitHub and npm, plus additional recommendations like immutable releases and package manager cooldowns.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.zachleat.com/web/npm-security/>

## Similar posts on daily.dev

- [Security Lessons For All From GitHub's Hardened Package Publication For npm](https://daily.dev/posts/security-lessons-for-all-from-github-s-hardened-package-publication-for-npm-9t300zqmx) · GitGuardian · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#github-actions](https://daily.dev/tags/github-actions), [#npm](https://daily.dev/tags/npm), [#supply-chain](https://daily.dev/tags/supply-chain)

[View this post on daily.dev](https://daily.dev/posts/no-more-tokens-locking-down-npm-publish-workflows-zachleat-com-5csi2gg7j)