Will It Vibe?npm registry auth token committed in config
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
An npm registry credential (an npm_ token, a :_authToken literal, or a base64 _auth) is committed in a readable config or env file, letting anyone publish or pull private packages as you.
Why it matters
An npm registry auth token committed in config lets anyone publish packages as you and read your private packages. A stolen publish token is a supply-chain risk: an attacker can push a malicious version that every consumer installs. The token stays valid and in git history until it is revoked.
How to fix it
Keep npm tokens out of tracked files. In CI, inject the token as a masked secret and write it to an ephemeral .npmrc with `//registry.npmjs.org/:_authToken=${NPM_TOKEN}`. Add .npmrc to .gitignore when it holds a token. Revoke the exposed token in your npm account settings and issue a new one.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo