feat: add npm trusted publishing detection#1161
Conversation
- Add npmjs registry constants and action coordinates - Detect npm/yarn/pnpm publish commands that should use trusted publishing - Improve detection logic to catch hybrid scenarios (id-token present but manual auth used) - Add comprehensive test cases for npm publishing workflows - Detect yarn run publish, npm run publish, pnpm run publish patterns Resolves npm package publishing security issues by recommending trusted publishing over manual NODE_AUTH_TOKEN usage.
Kusari Analysis Results:
No pinned version dependency changes, code issues or exposed secrets detected! Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
|
Awesome, thanks @KristianGrafana! I'll try and review this tonight. |
|
Kusari PR Analysis rerun based on - 3eab607 performed at: 2025-09-18T02:31:55Z - link to updated analysis |
Signed-off-by: William Woodruff <william@yossarian.net>
|
Kusari PR Analysis rerun based on - eae6c03 performed at: 2025-09-18T11:59:56Z - link to updated analysis |
| } else { | ||
| // Medium confidence when no id-token - could be intentional for non-TP registries | ||
| Confidence::Medium | ||
| }; |
There was a problem hiding this comment.
@KristianGrafana Thoughts on this being low-confidence instead? I suspect this will snare a lot of third-party index users (especially in ecosystems like Python where 3p indices are common).
There was a problem hiding this comment.
(But I also don't feel super confident about that either, so I'm curious what you think.)
There was a problem hiding this comment.
@woodruffw Good point, agree. id-token is mandatory for TP so Low makes more sense. Thanks! Added in d8794bb
- Change confidence from Medium to Low for publishing commands when no id-token permission - High confidence: has id-token but uses manual tokens (hybrid/incomplete migration) - Low confidence: no id-token, uses manual tokens (suggestions, could be intentional) - Reduces noise and provides more nuanced confidence scoring - Update test snapshots to reflect improved confidence levels
|
Kusari PR Analysis rerun based on - d8794bb performed at: 2025-09-18T14:57:23Z - link to updated analysis |
woodruffw
left a comment
woodruffw
left a comment
There was a problem hiding this comment.
Thanks @KristianGrafana, this looks great to me!
(The online snapshots need to be bumped too, but I can do that later today unless you feel like it. There are steps in the development docs 🙂)
Signed-off-by: William Woodruff <william@yossarian.net>
|
Kusari PR Analysis rerun based on - 10b1ece performed at: 2025-09-18T23:20:29Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - 29f9df9 performed at: 2025-09-18T23:20:55Z - link to updated analysis |
Signed-off-by: William Woodruff <william@yossarian.net>
|
Kusari PR Analysis rerun based on - e01dd91 performed at: 2025-09-18T23:22:15Z - link to updated analysis |
|
Thanks again @KristianGrafana! |
2 participants
This PR adds comprehensive npm trusted publishing detection to zizmor.
Changes Made
actions/setup-nodeuses npmjs registry with manual authenticationnpm publish,yarn run publish,pnpm publish, etc.id-token: writebut still use manual tokens (incomplete migration)This addresses the gap in npm package publishing security by recommending trusted publishing over manual token usage.