# Package publishing security: control who can ship and what consumers execute

Source: https://www.web3sec.news/blog/package-publishing-security-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Reconcile registry maintainers with current staff.
- [ ] Trace source, build, artifact and runtime loading.
- [ ] Use a restricted publishing identity and inspect provenance.
- [ ] Inspect package contents before release.
- [ ] Test revoked maintainers and unauthorized workflow contexts.

## References
- [npm: trusted publishing](https://docs.npmjs.com/trusted-publishers/)
- [npm: generating provenance statements](https://docs.npmjs.com/generating-provenance-statements/)