Automated npm Token and Access Audit
Every Monday, WebRun opens npm, lists the access tokens on the publishing account with when each was last used, reads the maintainers on every package and the members of your organization, checks two-factor settings, posts the findings to Microsoft Teams, and drafts the revoke list in Gmail for approval.
How do I audit who can publish my npm packages?
WebRun reviews your npm publish rights every Monday. It reads the access tokens with their last used dates, the maintainers on each package, your organization members and the two-factor setting, posts the findings to Microsoft Teams, and drafts a revoke list in Gmail, so nothing forgotten still holds the keys.
- Stale tokens are named every week with their last used date
- Maintainers who left stop holding publish rights
- A missing two-factor requirement is flagged plainly
Built for package maintainers · engineering leads · security teams · open source projects
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
www.npmjs.com/loginin a real browser with your saved login - no setup, no API keys. -
1
npm - review tokens and maintainers
npmjs.com
WebRun opens npm to review tokens and maintainers. - Open npm and list the access tokens on the publishing account
- Note each token's type, its scope and when it was last used
- Open each package you own and read its maintainer list
- List the organization members and the teams they sit in
- Check whether two-factor authentication is required for publishing
- Mark tokens unused for longer than your window, maintainers who have left, and members with rights they no longer need
Done when Every token, maintainer and organization member has been reviewed.
-
2
Microsoft Teams - post the findings
microsoft.com
WebRun opens Microsoft Teams to post the findings. - Post this week's findings to the engineering channel
- List the stale tokens first with their last used date
- List the maintainers and organization members to review, package by package
- Flag it plainly if two-factor is not required for publishing
- Note how many packages and tokens were checked
Done when The engineering channel has this week's publish rights review.
-
3
Gmail - draft the revoke list
gmail.com
WebRun opens Gmail to draft the revoke list. - Draft an email to the package owner listing the tokens and people proposed for removal
- Give the reason and the last used date against each line
- Leave the message in Drafts. WebRun never sends it
- Leave every revocation to a human. WebRun never revokes a token, removes a maintainer, or changes organization membership
Done when The revoke list is drafted and waiting on the owner's approval.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it revoke a token by itself?
No. WebRun only reviews and reports. Revoking a token, removing a maintainer, and changing organization membership all stay with the package owner.
Is the revoke email sent automatically?
No. It is left in Gmail Drafts with a reason and a last used date against every line, so the owner reads and sends it themselves.
What counts as a stale token?
One unused for longer than the window you set, for example 90 days. Its type, scope and last used date are shown so you can judge each one rather than guess.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.