I help maintain the npm CLI.

I am a current steward of npm.

February 2024

I started working at GitHub on npm.

The pages that follow are a few of the things I've worked on in the npm CLI so far.

01 / Before publish

Developers shouldn't have to guess about the build tools.

I added devEngines support to npm. Unlikeengines for package users, it checks the runtime and package manager used by contributors.

"devEngines": {
  "runtime": { "name": "node" },
  "packageManager": { "name": "npm" }
}

PR #7766 · mergedfeat: devEngines ↗

02 / No stored publish secret

CI can prove who it is instead of holding an npm token.

I added OIDC publishing to the CLI. npm gets a short-lived identity token from the CI provider, exchanges it with the registry for a package-scoped token, publishes, and throws the token away.

CI identity→registry exchange→short-lived token

PR #8336 · mergedadds support for OIDC publish ↗