feat: npm trust command #8899
Open
feat: npm trust command #8899
+7,326
−328
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
wraithgar
reviewed
Jan 12, 2026
wraithgar
reviewed
Jan 12, 2026
owlstronaut
approved these changes
Jan 22, 2026
Contributor
owlstronaut
left a comment
owlstronaut
left a comment
There was a problem hiding this comment.
I'm happy with this. Just a couple of nits, but I think this will be a great architecture to build from.
I skipped over reviewing the tests as I only have so much time on this beautiful planet
| static positionals = null | ||
|
|
||
| // this is a static so that we can read from it without instantiating a command | ||
| // this is a static so that we can read =rom it without instantiating a command |
Contributor
There was a problem hiding this comment.
Suggested change
| // this is a static so that we can read =rom it without instantiating a command | |
| // this is a static so that we can read from it without instantiating a command |
Mistype?
Comment on lines
+40
to
+41
| #argv = undefined | ||
| #excludeNpmCwd = undefined |
| // Throw error if unknown flags were found | ||
| if (unknownFlags.length > 0) { | ||
| const flagList = unknownFlags.map(f => `--${f}`).join(', ') | ||
| throw new Error(`Unknown flag${unknownFlags.length > 1 ? 's' : ''}: ${flagList}`) |
Contributor
There was a problem hiding this comment.
would a usageError be nice here?
| await this.confirmOperation(yes) | ||
| const trustConfig = this.constructor.optionsToBody(options.values) | ||
| const response = await this.createConfig(options.values.package, [trustConfig]) | ||
| const body = await response.json(yes) |
Contributor
There was a problem hiding this comment.
Suggested change
| const body = await response.json(yes) | |
| const body = await response.json() |
I think you only wanted this for the this.confirmationOperation above
dhei
reviewed
Jan 23, 2026
| } | ||
| await this.confirmOperation(yes) | ||
| const trustConfig = this.constructor.optionsToBody(options.values) | ||
| const response = await this.createConfig(options.values.package, [trustConfig]) |
Member
There was a problem hiding this comment.
Should the request body be an object trustConfig or an array of single object [trustConfig]?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introducing
npm trust🎉A new command / set of registry api endpoints that allows a user to add, remove and check the Trusted configurations between npm's registry and Trusted Publishers.
This command will allow maintainers to have a mechanism for managing their configurations outside of the npm website.
A lot of maintainers have mentioned how they'd like to be able to set Trusted Publishing "in bulk" and this solution allows maintainers to setup a simple bash script to loop over and set these configurations for many packages / repositories quickly.
These commands will require two-factor auth, it's not based on package access settings, or your account having 2fa enabled. The two-factor confirmation page will have the 2fa "cooldown" checkbox like
npm publishwhich will allow you to not have to re-enter the 2fa for this endpoint for a set amount of time for a given IP address.