## TL;DR
An npm token often works against more than npmjs: mirrors and proxies (Verdaccio, Artifactory, GitHub Packages) may accept or forward it. Revoke at the source registry, then revoke or rotate at every mirror and proxy, update CI, and verify the old token gets a 401 everywhere. One revocation is not enough.

## Error
```text
leaked npm token -  rotation failed across registries
```

## Steps
1. Revoke at the source: run `npm token revoke` for the leaked token on the primary registry, or delete it in the registry's web UI. Expected: the token disappears from the token list.
2. Inventory the mirrors: list every registry your teams and CI use (check `.npmrc` files, CI config, and proxy setups like Verdaccio or Artifactory). Expected: a complete list, because any missed mirror keeps the token alive.
3. Rotate at each mirror: revoke or rotate the token in each proxy's user or token store, and update any upstream auth it forwards. Expected: no mirror still accepts the old token.
4. Update consumers: replace the token in CI secret stores, developer `.npmrc` files, and automation. Expected: builds authenticate with the new token.
5. Verify the kill: attempt an authenticated operation with the old token against each registry and confirm 401. Expected: the old token is dead everywhere.

## When to use
- An npm token leaked and rotation seems incomplete
- Teams use mirrors or proxies in front of npmjs
- Auditing token hygiene after an incident

## When not to use
- Registry outages (availability, not credentials)
- Tokens that were never distributed beyond one registry

## Tool compatibility
- npm CLI (`npm token`), npmjs, Verdaccio, Artifactory, GitHub Packages registries

## Variant phrasings
### npm token still works after revoke
A mirror or proxy is still honoring it; revoke there too and verify with a 401 test.

### rotate npm token in ci
Update the CI secret store and every `.npmrc` reference; a stale copy in one job keeps the old token in use.

## Why it happens
npm auth is per-registry, and proxies often forward or independently validate tokens. Revoking only at npmjs leaves the token valid wherever else it was configured, so rotation must be a checklist across the whole registry fleet, not a single command.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mXcJDdoIIIAOuvq8ma8jmA