publish-safe
Advanced tools
CLI tool to help npm maintainers audit and migrate to trusted publishing safely.
npx publish-safe
audit - Check current publish configurationnpx publish-safe audit
fix - Generate patches to migrate to trusted publishingnpx publish-safe fix
Creates 2 files in .publish-safe/:
publish-workflow.yml - New GitHub Actions workflowmigration-checklist.md - Migration checklistverify - Verify setup is correctnpx publish-safe verify
doctor - Explain security conceptsnpx publish-safe doctor
init-ci - Create GitHub Actions workflow for continuous auditingnpx publish-safe init-ci
Creates .github/workflows/publish-safe-audit.yml for automated security checks.
All commands support JSON output:
npx publish-safe audit --json
npx publish-safe verify --json
CLI tool giúp npm maintainers audit và migrate sang trusted publishing một cách an toàn.
npx publish-safe
audit - Kiểm tra cấu hình publish hiện tạinpx publish-safe audit
fix - Tạo patch để migrate sang trusted publishingnpx publish-safe fix
Tạo ra 2 file trong .publish-safe/:
publish-workflow.yml - GitHub Actions workflow mớimigration-checklist.md - Checklist để migrateverify - Kiểm tra setup đã đúng chưanpx publish-safe verify
doctor - Giải thích khái niệm bảo mậtnpx publish-safe doctor
init-ci - Tạo GitHub Actions workflow để audit liên tụcnpx publish-safe init-ci
Tạo ra .github/workflows/publish-safe-audit.yml để kiểm tra bảo mật tự động.
Tất cả commands hỗ trợ JSON output:
npx publish-safe audit --json
npx publish-safe verify --json
FAQs
Migration & verification tool for secure npm publishing
We found that publish-safe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.