npm classic tokens were revoked 2025-12-09 and granular write tokens now expire in 90 days. Finds the token, OIDC and provenance gaps that will 401 your next release, in GitHub Actions and GitLab CI. Runs entirely in your browser — nothing is uploaded.
Free here: Scans the open workflow, .npmrc or package.json and names every npm publish credential, OIDC and provenance gap with line numbers - the whole check, no key. In the editor: Exports the finished audit as a dated Markdown/CSV file you keep and hand to a reviewer, for every workflow in the repo in one pass — that part asks for a licence key.
Same engine as the VS Code extension, byte for byte.