skills.rest
tacogips
tacogipsCOMMUNITY
Explore all skills by this author →
𝕏@yu_kawa_tacoGitHub

supply-chain-secure-publish

Secure npm package publishing with 2FA, provenance signing, and GitHub Actions.

1|Updated Feb 3, 2026
Search Tags:#publishing#security#npm#github actions#provenance#bun#supply chain
One-click install
npx skills add https://github.com/tacogips/QraftBox --skill supply-chain-secure-publish
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supply-chain-secure-publish
Source: https://github.com/tacogips/QraftBox/tree/main/.agents/skills/supply-chain-secure-publish
Command: npx skills add https://github.com/tacogips/QraftBox --skill supply-chain-secure-publish

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides robust security measures to prevent supply chain attacks during the creation and publishing of npm packages, ensuring the integrity and safety of your code.

Core Features & Use Cases

  • npm Account Security: Enforces 2FA and provides best practices for npm token management.
  • Trusted Publishing: Integrates with GitHub Actions using OIDC to eliminate stored secrets.
  • Package Provenance: Enables verifiable links between published code and its source.
  • Pre-Publish Checklist: Guides users through essential security checks before publishing.
  • Use Case: A developer is setting up a CI/CD pipeline to publish a new npm package and wants to ensure it's protected against common supply chain vulnerabilities like those seen in the Shai-Hulud attacks.

Quick Start

Use the supply-chain-secure-publish skill to set up trusted publishing for your npm package using GitHub Actions.

Frequently Asked Questions about supply-chain-secure-publish

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely publish npm packages with Bun using GitHub Actions?▼

To securely publish npm packages with Bun, use trusted publishing via GitHub Actions OIDC to eliminate stored secrets, enforce 2FA for npm accounts, and enable package provenance signing to verify source integrity.

What is npm package provenance signing and why do I need it?▼

Npm package provenance signing creates verifiable links between your published code and its source repository. You need it to prevent supply chain attacks by ensuring package integrity and protecting against compromised maintainer accounts.

How does trusted publishing work for npm packages in CI/CD pipelines?▼

Trusted publishing for npm packages works by integrating GitHub Actions with OIDC tokens, eliminating the need to store long-lived npm tokens as repository secrets and preventing unauthorized access if the CI/CD environment is compromised.

Can I eliminate stored npm tokens when publishing from GitHub Actions?▼

Yes, you can eliminate stored npm tokens when publishing from GitHub Actions by implementing trusted publishing with OIDC, which securely authenticates your Bun package releases without exposing static credentials.

What pre-publish security checklist should I follow for npm packages?▼

A pre-publish security checklist for npm packages should include enforcing 2FA, validating npm token permissions, enabling provenance signing, and verifying trusted publishing configurations to mitigate malicious code injection risks.

What is the Shai-Hulud supply chain attack and how do I prevent it?▼

The Shai-Hulud supply chain attack involves compromising maintainer accounts to inject malicious code into npm packages. Prevent it by enforcing 2FA, using GitHub Actions OIDC trusted publishing, and enabling provenance signing for Bun packages.

Related Skills

Explore More Software Engineering Skills→
joelhooksjoelhooks
729

publish-package-cicd

Automate npm package publishing for monorepos with Changesets and OIDC.

Community
Advanced
vercelvercel
26.1k

list-npm-package-content

List npm package tarball contents before publishing.

Official
Intermediate
AradotsoAradotso
11

npm-security-best-practices

Harden npm, pnpm, and Bun installs against supply-chain attacks.

Official
Advanced
spencerbeggsspencerbeggs
2

supply-chain-attestation

Generate, sign, and upload CycloneDX SBOMs and SLSA provenance predicates.

Community
Advanced