npm trusted publishing now supports CircleCI, plus dark mode for npmjs.com

[leobalter]

Hey everyone 👋

We just shipped two updates to npm - here's what's new.

Trusted publishing: CircleCI support now GA

npm Trusted publishing now supports CircleCI as an OIDC provider, joining GitHub Actions and GitLab CI/CD. If you publish from CircleCI, you can now eliminate stored credentials and authenticate directly through your CI/CD pipeline.

Getting started:

• npm Trusted Publishing documentation
• CircleCI OIDC tokens documentation

Configuration is available through the npm website or the npm trust CLI command.

Dark Mode for npmjs.com 🌙

One of the most requested community features is here. You can toggle between dark mode, light mode, and system mode using the new icon in the top navigation header on npmjs.com.

A note on this: our team is fully focused on npm security hardening - and that hasn't changed. We built Dark Mode using GitHub Copilot agent mode, which allowed us to deliver it with minimal engineering time beyond final review and shipping. We wanted to ship something the community has been asking for without pulling focus from security work.

What's ahead

Our priority remains strengthening npm security and enhancing maintainer agency over published packages. We have a lot of security work ahead of us, including adding safeguards around sensitive account changes and improving proof of presence for publishes. More to share soon.

We'd love to hear your feedback on both features - drop your thoughts below!

[gameroman]

❤️❤️❤️ THANK YOU ❤️❤️❤️

[sks-007]

Trusted publishing with CircleCI is a big win for security removing stored credentials and using OIDC makes the pipeline much safer and cleaner.

[taimoordevop]

thats awesome

[meeech]

@leobalter thanks for getting this out.

feedback: Since vcs-origin is required, why not make vcs-ref an optional? this would make it much simpler for people to lock down their publish to a specific branch.

[ryanobjc]

When will you support self hosted runners on Github Actions?

[jedwards1211]

@leobalter CircleCI trusted publishing is still not working for me for monorepo packages!

https://devactivity.com/insights/monorepo-publishing-woes-oidc-trusted-publishing-fails-for-nested-packages-impacting-engineering-productivity/

circleci@4de072a8acf6:~/project/packages/base$ export NPM_ID_TOKEN=$(circleci run oidc get --claims '{"aud": "npm:registry.npmjs.org"}')
circleci@4de072a8acf6:~/project/packages/base$ echo $NPM_ID_TOKEN
eyJhbGciOi...4Z88ZGKLkZrCw
circleci@4de072a8acf6:~/project/packages/base$ npm publish . --tag trusted-publish --provenance --loglevel silly
...
npm warn publish "repository.url" was normalized to "git+https://github.com/jcoreio/toolchains.git"
...
npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@jcoreio%2ftoolchain 845ms
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found
npm verbose stack Error: This command requires you to be logged in to https://registry.npmjs.org/
npm verbose stack     at #publish (/usr/local/lib/node_modules/npm/lib/commands/publish.js:171:29)
npm verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
npm verbose stack     at async Publish.exec (/usr/local/lib/node_modules/npm/lib/commands/publish.js:51:5)
npm verbose stack     at async Npm.exec (/usr/local/lib/node_modules/npm/lib/npm.js:194:9)
npm verbose stack     at async module.exports (/usr/local/lib/node_modules/npm/lib/cli/entry.js:67:5)
npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/
npm error need auth You need to authorize this machine using `npm login`
npm error A complete log of this run can be found in: /home/circleci/.npm/_logs/2026-08-26T19_44_56_502Z-debug-0.log
circleci@4de072a8acf6:~/project/packages/base$ npm -v
12.0.2

Claims in NPM_ID_TOKEN:

{
  "aud": "npm:registry.npmjs.org",
  "exp": 1787777087,
  "iat": 1787773487,
  "iss": "https://oidc.circleci.com/org/3cccXXXX-XXXX-XXXX-XXXX-XXXXXXXXebb3",
  "oidc.circleci.com/context-ids": [
    "58c5XXXX-XXXX-XXXX-XXXX-XXXXXXXX591d"
  ],
  "oidc.circleci.com/job-id": "2c13XXXX-XXXX-XXXX-XXXX-XXXXXXXXc7fb",
  "oidc.circleci.com/org-id": "3cccXXXX-XXXX-XXXX-XXXX-XXXXXXXXebb3",
  "oidc.circleci.com/pipeline-definition-id": "3f43XXXX-XXXX-XXXX-XXXX-XXXXXXXXc136",
  "oidc.circleci.com/pipeline-id": "e10bXXXX-XXXX-XXXX-XXXX-XXXXXXXX86db",
  "oidc.circleci.com/project-id": "ea26XXXX-XXXX-XXXX-XXXX-XXXXXXXX8587",
  "oidc.circleci.com/ssh-rerun": true,
  "oidc.circleci.com/vcs-origin": "github.com/jcoreio/toolchains",
  "oidc.circleci.com/vcs-ref": "refs/heads/npm-trust-circle",
  "oidc.circleci.com/workflow-id": "c091XXXX-XXXX-XXXX-XXXX-XXXXXXXXc22b",
  "sub": "org/3cccXXXX-XXXX-XXXX-XXXX-XXXXXXXXebb3/project/ea26XXXX-XXXX-XXXX-XXXX-XXXXXXXX8587/user/.../vcs-origin/github.com/jcoreio/toolchains/vcs-ref/refs/heads/npm-trust-circle"
}

Trusted publishing config copied from npmjs.com:

Organization ID:3cccXXXX-XXXX-XXXX-XXXX-XXXXXXXXebb3
Project ID:ea26XXXX-XXXX-XXXX-XXXX-XXXXXXXX8587
Pipeline Definition ID:3f43XXXX-XXXX-XXXX-XXXX-XXXXXXXXc136
Version Control Source Origin:github.com/jcoreio/toolchains
Permissions: npm publish

I also tried adding the context id to the trusted publishing config, same result.

I have no .npmrc files anywhere (npm config get globalconfig and npm config get userconfig files don't exist, nothing in the project)

[leobalter]

if you''ve found a bug, please file a support ticket so we can track it with our oncall team.

https://www.npmjs.com/support

[leobalter]

If you also inform in the ticket the packages you're trying to publish, I can take a quick look at their existing oidc configuration. The trusted publishing configuration must be set per package.

[jedwards1211]

@leobalter I'll try again, but when I tried yesterday but the npm support form was erroring out...I tried refreshing the page and resending, eventually got rate limited.

[leobalter]

I did a double check with the team and this is working as intended.

Please take a look at the docs from https://circleci.com/docs/guides/deploy/deploy-to-npm-registry/ at the "SSH rerun restrictions" section.

For security it's important that npm rejects OIDC tokens from SSH reruns.

[jedwards1211]

@leobalter Oh ffs, trying to get something like this working by continually pushing changes is like pulling teeth
I'm asking them to log a helpful warning when the command to get an OIDC is run in an SSH rerun session, because I wouldn't have thought to look for this in a million years

[jedwards1211]

Would it be possible for the NPM cli to print an explanatory warning in this case too? It could be way more obvious than it currently is

[jedwards1211]

@leobalter "package not found" is just a bad error message when the actual error is "not allowed in SSH reruns"

[jedwards1211]

@leobalter also, we shouldn't have to change the log level to get the npm cli to print OIDC token exchange errors.

[tats-u]

System mode should be default at least eventually.