[{"data":1,"prerenderedAt":112},["ShallowReactive",2],{"blog-oidc-credentials-enhance-security-for-npm-dist-tag-management":3},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"tags":11,"cover":17,"body":18,"_type":106,"_id":107,"_source":108,"_file":109,"_stem":110,"_extension":111},"/blog/oidc-credentials-enhance-security-for-npm-dist-tag-management","blog",false,"","OIDC Credentials Enhance Security for npm Dist-Tag Management","npm now allows trusted publishing setups to manage dist-tags using short-lived OIDC credentials, improving control and security over package versions.","2026-10-01",[12,13,14,15,16],"npm","security","devops","oidc","publishing",true,{"type":19,"children":20,"toc":99},"root",[21,30,61,67,72,78,83,89,94],{"type":22,"tag":23,"props":24,"children":26},"element","h2",{"id":25},"improved-security-for-npm-publishing",[27],{"type":28,"value":29},"text","Improved Security for npm Publishing",{"type":22,"tag":31,"props":32,"children":33},"p",{},[34,36,43,45,51,53,59],{"type":28,"value":35},"npm has introduced an update that allows trusted publishing configurations to manage distribution tags (dist-tags) such as ",{"type":22,"tag":37,"props":38,"children":40},"code",{"className":39},[],[41],{"type":28,"value":42},"latest",{"type":28,"value":44},", ",{"type":22,"tag":37,"props":46,"children":48},{"className":47},[],[49],{"type":28,"value":50},"next",{"type":28,"value":52},", and ",{"type":22,"tag":37,"props":54,"children":56},{"className":55},[],[57],{"type":28,"value":58},"beta",{"type":28,"value":60}," through short-lived OpenID Connect (OIDC) credentials.",{"type":22,"tag":23,"props":62,"children":64},{"id":63},"what-are-dist-tags",[65],{"type":28,"value":66},"What are Dist-Tags?",{"type":22,"tag":31,"props":68,"children":69},{},[70],{"type":28,"value":71},"Dist-tags are labels used in npm to point to specific versions of a package, helping developers control which version users get by default or through different release channels.",{"type":22,"tag":23,"props":73,"children":75},{"id":74},"advantages-of-oidc-credentials",[76],{"type":28,"value":77},"Advantages of OIDC Credentials",{"type":22,"tag":31,"props":79,"children":80},{},[81],{"type":28,"value":82},"Using short-lived OIDC tokens for these permissions enhances security by reducing the risks associated with long-lived credentials. It aligns package management with modern security practices, providing better control and audibility.",{"type":22,"tag":23,"props":84,"children":86},{"id":85},"impact-on-developers-and-maintainers",[87],{"type":28,"value":88},"Impact on Developers and Maintainers",{"type":22,"tag":31,"props":90,"children":91},{},[92],{"type":28,"value":93},"Maintainers now have a more secure and standardized process for updating and promoting package versions, ensuring that only trusted configurations can update dist-tags dynamically while minimizing exposure risks.",{"type":22,"tag":31,"props":95,"children":96},{},[97],{"type":28,"value":98},"This update reflects ongoing efforts to improve npm’s security posture and support safer package distribution workflows.",{"title":7,"searchDepth":100,"depth":100,"links":101},2,[102,103,104,105],{"id":25,"depth":100,"text":29},{"id":63,"depth":100,"text":66},{"id":74,"depth":100,"text":77},{"id":85,"depth":100,"text":88},"markdown","content:blog:oidc-credentials-enhance-security-for-npm-dist-tag-management.md","content","blog/oidc-credentials-enhance-security-for-npm-dist-tag-management.md","blog/oidc-credentials-enhance-security-for-npm-dist-tag-management","md",1790839121868]