# npm Trusted Publishing Hacker Approved page: https://hackerapproved.com/p/npm-trusted-publishing/ 7 people recommended npm Trusted Publishing in Hacker News comments, 2 had mixed feelings and 16 criticized it, November 2025 to October 2026. It was recommended in 5 of 12 months, in 7 threads. It does not meet the Hacker Approved badge rule. **Verdict:** More people criticize it than recommend it. Removes long-lived npm tokens from CI pipelines by using short-lived OIDC credentials for publishing. Caveat: critics say it is not enough alone and is limited to some CI platforms. Summary written by Claude from the comments below. ## What people warn about - Only some CI platforms supported (4 comments in the sample): "trusted publishing" means a type of reverse vendor lock in? Only some CI systems are allowed to be used for it." ([source](https://news.ycombinator.com/item?id=46533028)) "NPM can and should support federating with CI/CD platforms other than GitHub Actions" ([source](https://news.ycombinator.com/item?id=46535468)) "trusted publishing doesn't solve that if you use self-hosted CI" ([source](https://news.ycombinator.com/item?id=46536216)) - Not enough alone; unnecessary (4 comments in the sample): "Trusted Publishing is still ~~not secure~~ not enough by itself to securely publish from CI" ([source](https://news.ycombinator.com/item?id=48101308)) "I'm struggling to understand why Trusted Publishers is any better." ([source](https://news.ycombinator.com/item?id=46037728)) "Standing on the sidelines it appears wholly unnecessary to me." ([source](https://news.ycombinator.com/item?id=46537784)) - Hard setup and poor documentation (3 comments in the sample): "all of the documentation for trusted publishing (NPM/PyPi/Rubygems) doesn't even mention this possibility" ([source](https://news.ycombinator.com/item?id=48101329)) "it seems like a rushed decision. poor coordination and incomplete docs" ([source](https://news.ycombinator.com/item?id=46491778)) "Turning on Trusted Publishers was a huge pain with so many package." ([source](https://news.ycombinator.com/item?id=46532318)) - Creates vendor lock-in (2 comments in the sample): "the path to dependency on closed publishers was opened wide with the introduction of both attestations and trusted publishing" ([source](https://news.ycombinator.com/item?id=46533286)) "If you rely on "Trusted Publishing" you are assisting Microsoft in making a moat for their CI platform." ([source](https://news.ycombinator.com/item?id=46334114)) ## Why people recommend it - Removes long-lived tokens and keys from CI (4 comments in the sample): "the risk of long-lived, highly privileged credentials is the primary motivating reason for Trusted Publishing" ([source](https://news.ycombinator.com/item?id=48107530)) "TP is amazing at removing long lived npm tokens from CI" ([source](https://news.ycombinator.com/item?id=48102416)) "You shouldn't have any keys anywhere at all. Use OIDC" ([source](https://news.ycombinator.com/item?id=46037273)) - Limits CI takeover and worm-style attacks (3 comments in the sample): "Trusted Publishing would make it harder for the parties behind Shai-Hulud to group and orchestrate the kinds of compromise waves we're seeing." ([source](https://news.ycombinator.com/item?id=46092603)) "it's a significant improvement that kills an entire class of CI takeover publish attacks" ([source](https://news.ycombinator.com/item?id=48245757)) "it eliminates/foreshortens the attack staging window significantly" ([source](https://news.ycombinator.com/item?id=46034074)) ## The badge A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged. ## Cite as Hacker Approved, "npm Trusted Publishing", https://hackerapproved.com/p/npm-trusted-publishing/ (7 recommend, 2 mixed, 16 criticize; Hacker News comments, November 2025 to October 2026). Counts updated 2 Nov 2026, with data through October 31, 2026.