A bypass token may still read packages.
That does not mean it can keep publishing them.
Map sanitized package/pipeline paths across npm's two deprecation windows. Separate sensitive management from direct publish, trusted OIDC from staged human approval, and token retirement from tested recovery—without exposing package identity, workflow or credentials.
npm publish authority migration map
| Path | Action | Current / target | OIDC / stage / approval | Token / test / fallback | Evidence / owner | Decision / result |
|---|
Authority, approval and token-retirement queue
“Evidence recorded” proves only coherent abstract metadata. This page did not inspect npm ownership, token scope, OIDC claims, stage queue, 2FA, artifact/provenance or logs; configure npm; revoke a token; publish a package; or guarantee release continuity/security.
Zero-package-data boundary: all free analysis stays in this browser. Enter only fictional aliases, enumerated states and safe evidence references. Never paste a real package/scope/account/org/team, repository/workflow, token, OTP, recovery code, OIDC subject, tarball, provenance, log or private data. This page does not inspect ownership or credentials, configure trusted/staged publishing, perform 2FA, revoke a token, publish, roll back or certify release continuity/security. Authorized npm, package, platform, security and release owners control every real action.
$18 npm Publish Authority Migration Evidence Pack
Export an editable matrix for up to 100 sanitized paths: two-window authority diff, sensitive action and direct-publish queue, trusted OIDC and staged/2FA handoff, token retirement, negative tests, fallback, sign-off and PMF ledger.
- up to 100 sanitized authority paths
- August sensitive-management versus January direct-publish matrix
- trusted OIDC identity and staged-publish approval handoff
- read/stage residual token scope and retirement queue
- negative publish/approval/fallback tests plus sign-off
- 45-day qualified-visit, use, intent and paid ledger
Current npm authority deprecation and native migration routes
PMF pre-judgment 92/100 · $18 one-time evidence pack under strong npm trust/stage and internal release substitutes