npm Access Token

Detects bounded npm access-token values (npm_ prefix, fixed 36-character body) and credential-bearing .npmrc authToken assignments; documentation and placeholder examples remain excluded. These tokens authenticate to the npm registry and can publish, unpublish or grant access to packages; a leak enables supply-chain attacks via malicious publishes.

Type

regex

Engine

universal

Confidence

high

Confidence justification

High confidence: the distinctive npm_ prefix with a fixed 36-character body makes false positives extremely unlikely.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth), Computer Fraud and Abuse Act, Computer Misuse Act 1990

Frameworks

CIS Controls, ISO 27001, NIST CSF, SOC 2

Data categories

credentials, security

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])

Corroborative evidence keywords

npm, npm token, registry, .npmrc, authToken, package

Proximity: 300 characters

Should match

• npm_ABCDEFGHIJ1234567890abcdefghij123456 — Exact 65 probe - fixed npm token structure without independent registry context
• npm package publish credential npm_aB3dE6gH9jK2mN5pQ8sTuVwXyZ0123456789 — Exact 75 probe - token with npm package-publish context
• npm registry publish //registry.npmjs.org/:_authToken=npm_Qw3rTy9zXcV8bNm2LkJ4hGf6DsA1pOiU7yTr — Exact 85 probe - npm registry context plus canonical npmrc assignment
• .npmrc credential //registry.npmjs.org/:_authToken=legacyRegistryTokenValue123456 — Legacy npmrc authToken structure remains context-gated

Should not match

• npm_tooShort1234 — Too short to be an npm access token
• ghp_ABCDEFGHIJ1234567890abcdefghij12345678 — GitHub token prefix, not npm
• PYPI_TOKEN=npm_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 — Sibling package-registry label does not corroborate an npm token
• install the package and set your npm token in CI — Prose mention without a token value
• NPM_TOKEN=npm_aB3dE6gH9jK2mN5pQ8sTuVwXyZ012345678 — 35-character body is one short of the fixed token length
• xnpm_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789z — Alphanumeric characters touch both boundaries, so the lookarounds reject the embedded substring
• Documentation example: npm registry NPM_TOKEN=npm_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 — Shared template-exclusion terms veto quoted instructional token material at the tier level

Known false positives

• Documentation or examples showing placeholder npm_ strings. Mitigation: Require corroborative npm/registry keywords and exclude placeholder markers.

References

• About npm access tokens

Collections

• Cloud Credentials & API Keys