npm Trusted Publish Lint - OIDC & tokens

It reads a release workflow, an .npmrc line or a package.json and reports every place your npm publish still leans on a credential with an expiry date. Fifteen rules cover stored tokens, missing id-token: write, missing provenance, mutable action refs and install scripts running beside your publish credential. Each finding lands on its own line with the fix named.

Node package maintainers and release engineers who publish to npm from GitHub Actions or GitLab CI - the solo maintainer with one publish.yml, and the platform engineer who owns forty of them in a monorepo. If your release job still carries NODE_AUTH_TOKEN or an .npmrc line, every rule here is about your file.

npm audit reads your dependency tree, not your workflow, and a secret scanner only fires on a literal token you committed. Neither one knows that classic tokens were revoked on 2025-12-09, that a granular write token cannot outlive 90 days, or that trusted publishing needs id-token: write in that exact job.

Free is the whole check: all 15 rules, every line, every file you open, in the editor or in the browser, with no key and no account. The paid layer changes what you take away - it sweeps every workflow in the repository in one pass and writes the audit to a dated Markdown or CSV file.

A freelance DevOps engineer is a median $60 an hour on Upwork, with the usual range running $40 to $100. Reading one release workflow line by line, checking it against npm's current token rules and rewriting it for OIDC is most of an hour. The extension is $29 once.