npm bulk trusted publishing config and script security

[leobalter]

now available in CLI v11.10.0+

We've shipped two new features to make npm publishing safer and easier to manage:

Bulk configuration for OIDC trusted publishing

Maintainers can now add or update trusted publishing configurations across multiple packages in a single operation using the npm trust command, instead of configuring each package individually.

This is a first step in making trusted publishing easier to adopt for all users and providers. CircleCI support is already in progress and coming soon, along with additional improvements to make migrating to and managing trusted publishing simpler for maintainers with many packages.

New --allow-git flag for npm install

Git dependencies — direct or transitive — can include .npmrc files that override the git executable path, enabling arbitrary code execution during install even when using --ignore-scripts. The new --allow-git flag gives you explicit control over this behavior.

The flag defaults to all for backward compatibility, but we highly encourage using --allow-git=none now and only re-enabling it when git dependencies are truly necessary:

npm install --allow-git=none

--allow-git=none is expected to become the default in npm CLI v12. See the documentation for details.

---

We'd love to hear your feedback — what's working, what's missing, and what would make these features better for your workflows. Let us know in the comments!

[robertobandini]

The bulk function is really useful, I happened to set it up manually on dozens of packages just last week, thanks!

[peterc]

Why wasn't min-release-age mentioned in this release post? It's in the repo's release page for v11.10.

[leobalter]

Great question and I don't a better excuse other than I focused only on 2 items for this release's changelog. Saying that, we have another changelog coming relatively soon and I'll include min-release-age.

[peterc]

😄 No problem! It just seemed significant (or at least topical) so I wondered if it wasn't quite ready for prime time or something like that.

[boramalper]

Hi @leobalter,

Thanks for allow-git, much appreciated. Are there any plans to add support for something like allow-tarballs (name TBD)? pnpm supports it via blockExoticSubdeps and I think it'd be great to support it in npm too.

[jedwards1211]

@leobalter

Couldn't trusted publishing support human-readable org, repo, and project names for CircleCI? Having to look up UUIDs for all of these different projects is going to suck. URLs for GitHub projects in the CircleCI webapp don't contain UUIDs, so it doesn't seem like they should be necessary in the trust config either.

[jedwards1211]

@leobalter I tried out npm trust and got a 400 error with no explanation:

$ npm trust circleci --org-id 00000000-0000-0000-0000-000000000000 --project-id 00000000-0000-0000-0000-000000000000 --pipeline-definition-id 00000000-0000-0000-0000-000000000000 --vcs-origin github/jcoreio/toolchains --context-id 00000000-0000-0000-0000-000000000000 --context-id 00000000-0000-0000-0000-000000000000
npm warn config optional Use `--omit=optional` to exclude optional dependencies, or
npm warn config `--include=optional` to include them.
npm warn config
npm warn config       Default value does install optional deps unless otherwise omitted.
npm warn Unknown user config "hoist". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
Establishing trust between @jcoreio/toolchains package and CircleCI
Anyone with CircleCI pipeline write access can publish to @jcoreio/toolchains
Two-factor authentication is required for this operation

package: @jcoreio/toolchains
orgId: 00000000-0000-0000-0000-000000000000
projectId: 00000000-0000-0000-0000-000000000000
pipelineDefinitionId: 00000000-0000-0000-0000-000000000000
vcsOrigin: github/jcoreio/toolchains
contextIds: 00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000

https://www.npmjs.com/package/@jcoreio/toolchains
https://github/jcoreio/toolchains

Do you want to proceed? (y/N) (n) y
npm error code E400
npm error 400 Bad Request - POST https://registry.npmjs.org/-/package/@jcoreio%2ftoolchains/trust
npm error A complete log of this run can be found in: /Users/andy/.npm/_logs/2026-05-20T15_55_00_535Z-debug-0.log

The log didn't have any helpful information either.

Does npm trust need to print a better error message if we have an npm token that bypasses 2fa in our .npmrc?

[jedwards1211]

I tried commenting out the npm token in my ~/.npmrc but it didn't make any difference.

[jedwards1211]

Oh I guess the issue is this package doesn't actually exist, it's my monorepo root.
A 400 response with no message doesn't feel like a quality API though

[jedwards1211]

Argh I tried passing one of the monorepo subpackages that's published to npm and I still got the no-reason 400 error:

Establishing trust between @jcoreio/toolchain-typescript package and CircleCI
Anyone with CircleCI pipeline write access can publish to @jcoreio/toolchain-typescript
Two-factor authentication is required for this operation

package: @jcoreio/toolchain-typescript
orgId: 00000000-0000-0000-0000-000000000000
projectId: 00000000-0000-0000-0000-000000000000
pipelineDefinitionId: 00000000-0000-0000-0000-000000000000
vcsOrigin: github/jcoreio/toolchains
contextIds: 00000000-0000-0000-0000-000000000000,00000000-0000-0000-0000-000000000000

https://www.npmjs.com/package/@jcoreio/toolchain-typescript
https://github/jcoreio/toolchains

Do you want to proceed? (y/N) (n) y
npm error code E400
npm error 400 Bad Request - POST https://registry.npmjs.org/-/package/@jcoreio%2ftoolchain-typescript/trust
npm error A complete log of this run can be found in: /Users/andy/.npm/_logs/2026-05-20T16_12_30_563Z-debug-0.log
Command failed with exit code 1: npm trust circleci @jcoreio/toolchain-typescript --org-id 00000000-0000-0000-0000-000000000000 --project-id 00000000-0000-0000-0000-000000000000 --pipeline-definition-id 00000000-0000-0000-0000-000000000000 --vcs-origin github/jcoreio/toolchains --context-id 00000000-0000-0000-0000-000000000000 --context-id 00000000-0000-0000-0000-000000000000

[jedwards1211]

Created an issue here: npm/cli#9377

This is so bad ugh