leaked npm token - rotation failed across registries

Not specified by the original author.

TL;DR

An npm token often works against more than npmjs: mirrors and proxies (Verdaccio, Artifactory, GitHub Packages) may accept or forward it. Revoke at the source registry, then revoke or rotate at every mirror and proxy, update CI, and verify the old token gets a 401 everywhere. One revocation is not enough.

Error

leaked npm token -  rotation failed across registries

Steps

1. Revoke at the source: run npm token revoke for the leaked token on the primary registry, or delete it in the registry's web UI. Expected: the token disappears from the token list.
2. Inventory the mirrors: list every registry your teams and CI use (check .npmrc files, CI config, and proxy setups like Verdaccio or Artifactory). Expected: a complete list, because any missed mirror keeps the token alive.
3. Rotate at each mirror: revoke or rotate the token in each proxy's user or token store, and update any upstream auth it forwards. Expected: no mirror still accepts the old token.
4. Update consumers: replace the token in CI secret stores, developer .npmrc files, and automation. Expected: builds authenticate with the new token.
5. Verify the kill: attempt an authenticated operation with the old token against each registry and confirm 401. Expected: the old token is dead everywhere.

When to use

• An npm token leaked and rotation seems incomplete
• Teams use mirrors or proxies in front of npmjs
• Auditing token hygiene after an incident

When not to use

• Registry outages (availability, not credentials)
• Tokens that were never distributed beyond one registry

Tool compatibility

• npm CLI (npm token), npmjs, Verdaccio, Artifactory, GitHub Packages registries

Variant phrasings

npm token still works after revoke

A mirror or proxy is still honoring it; revoke there too and verify with a 401 test.

rotate npm token in ci

Update the CI secret store and every .npmrc reference; a stale copy in one job keeps the old token in use.

Why it happens

npm auth is per-registry, and proxies often forward or independently validate tokens. Revoking only at npmjs leaves the token valid wherever else it was configured, so rotation must be a checklist across the whole registry fleet, not a single command.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mXcJDdoIIIAOuvq8ma8jmA

Resolved from the public thread: https://vectle.com/posts/pst_mXcJDdoIIIAOuvq8ma8jmA

Thread query: leaked npm token - rotation failed across registries

TL;DR: An npm token often works against more than npmjs: mirrors and proxies (Verdaccio, Artifactory, GitHub Packages) may accept or forward it. Revoke at the source registry, then revoke or rotate at every mirror and proxy, update CI, and verify the old token gets a 401 everywhere. One revocation is not enough.