# npm-trusted-publishing-security
Source: https://speakeasy.com/blog/npm-trusted-publishing-security


import { Callout } from "@/lib/mdx/components";

The npm ecosystem is evolving, and if you're publishing TypeScript or MCP TypeScript SDKs, there are important changes on the horizon that you need to know about.

## The Landscape is Changing

In the wake of recent supply chain attacks targeting the NPM ecosystem, the maintainers have made a decisive move to strengthen security across the platform. At the heart of these changes is a recognition that long-lived authentication tokens—once a convenient standard—have become a significant security vulnerability.

Starting in October, NPM introduced a fundamental shift: all newly created write-enabled granular access tokens now come with a default expiration of just seven days, with a maximum lifespan of 90 days. But that's just the beginning.

In the coming weeks, NPM will take two additional steps:

- Revoking all existing legacy classic tokens for npm publishers
- Permanently disabling legacy classic token generation on npmjs.com

If your publishing workflow relies on these tokens, the clock is ticking.

## A Better Way Forward: Trusted Publishing

Rather than simply adapting to shorter-lived tokens and the rotation headaches they bring, there's a more elegant solution: **Trusted Publishing**.

At Speakeasy, we strongly recommend migrating to [trusted publishing](https://docs.npmjs.com/trusted-publishers) for your publishing workflows. Here's why it's worth the effort:

- **Simplified authentication** using OpenID Connect (OIDC)—no more juggling tokens
- **Zero token rotation** required—ever
- **Automatic provenance attestation** for enhanced supply chain security

It's not just more secure; it's actually easier to maintain.

## What You Need to Do

### Step 1: Update Your GitHub Workflow Permissions

First, ensure your GitHub workflows have the necessary permissions to generate OIDC tokens. Add the `id-token: write` permission to any workflows used for publishing NPM packages:

```yaml
name: Publish
permissions:
  checks: write
  contents: write
  pull-requests: write
  statuses: write
  id-token: write # Required for OpenID Connect (OIDC)
```

<Callout title="Pro tip" type="info">
  Not sure if you've got it right? Run `speakeasy configure publishing` in your
  local repository. This command will automatically add the required permission
  and provide instructions tailored to your specific SDK configuration.
</Callout>

### Step 2: Configure Trusted Publishing on NPM

Head over to your package settings on [npmjs.com](https://npmjs.com) and [configure trusted publishing](https://docs.npmjs.com/trusted-publishers#configuring-trusted-publishing):

1. Select **GitHub Actions** as your _Trusted Publisher_
2. Enter the GitHub **user** and **Repository Name** for your SDK
3. Identify your publishing workflow file (typically found in `.github/workflows/`):
   - For `pr` mode: usually `sdk_publish.yaml`
   - For `direct` mode: usually `sdk_generation.yaml`
4. Leave the **Environment** field blank
5. Keep the **"Don't require two-factor authentication"** option selected in the `Publishing access` section.

### Step 3: Test Your Configuration

Before you celebrate, let's make sure everything works:

1. Navigate to your repository's **Actions** tab on GitHub
2. Run the **Generate** workflow with these settings:
   - ✅ Check the `Force generation of SDKs` box
   - Bump the SDK version using the optional `set a specific SDK version` field
3. Once published, visit your package on [npmjs.com](https://npmjs.com)

Look for two things that confirm success:

- A green checkmark ✓ indicating the package was published using OIDC
- A **Provenance** badge at the end of the README

## The Bottom Line

The NPM ecosystem is moving toward a more secure future, and trusted publishing is the path forward. While these changes might require a bit of setup work now, they'll save you time and headaches down the road—not to mention significantly improving your supply chain security posture.

Don't wait until your legacy tokens are revoked. Make the transition to trusted publishing today, and publish with confidence.

---

_Questions about setting up trusted publishing for your Speakeasy-generated SDKs? Check out our [documentation](https://docs.npmjs.com/trusted-publishers) or reach out to our support team._