LandonSchropp/npm-publish
plugins/ls-typescript/skills/npm-publish/SKILL.md
Use when publishing or releasing a new version of an npm/pnpm/yarn/bun package to the registry. Covers package-manager detection, semver bump selection, tagging, pushing, scoped-package access, authentication, and one-time passwords (OTP).
$ install --global
skillsauthnpx skillsauth add LandonSchropp/agent-toolkit npm-publishInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 1, 2026, 2:14 AM200.1s1 file scanned
SKILL.md
- name:
- npm-publish
- description:
- Use when publishing or releasing a new version of an npm/pnpm/yarn/bun package to the registry. Covers package-manager detection, semver bump selection, tagging, pushing, scoped-package access, authentication, and one-time passwords (OTP).
Pre-flight checks
Do these BEFORE bumping the version — fail before creating a commit and tag, not after.
- Authenticated. Run
npm whoami. A401means you're not logged in: STOP and resolve it before anything else.npm loginis interactive (browser-based), so you cannot run it for the user — ask them to (in Claude Code,! npm login), then re-checknpm whoami. Don't bump or commit until this passes. - Clean working tree. Run
git status. Commit or stash changes first. - Tests and lint pass. Run the project's test and lint scripts. NEVER publish a red build.
- Right branch, up to date. Releases normally happen from
main.
Package manager
Detect from the lockfile (first match wins) and use that row's commands:
| Lockfile | Bump | Publish |
| ----------------------------- | ----------------------- | -------------- |
| yarn.lock | yarn version --<bump> | yarn publish |
| pnpm-lock.yaml | pnpm version <bump> | pnpm publish |
| bun.lock / bunfig.toml | npm version <bump> | bun publish |
| package-lock.json (or none) | npm version <bump> | npm publish |
Both steps only touch package.json and the registry, so npm version / npm publish are safe fallbacks when a manager's syntax differs (e.g. Yarn Berry publishes with yarn npm publish).
Bump, push, and publish
- Bump. Pick the level — major (breaking), minor (new backward-compatible feature), or patch (fix/internal only); ask if unsure. Run the bump command for your manager. It edits
package.json, commits, and creates av<version>tag. - Push the commit and tag:
git push --follow-tags. REQUIRED:--follow-tags, or the tag stays on your machine. - Publish with your manager's command plus
--access public. REQUIRED for scoped packages (@scope/name): without it npm publishes privately and rejects a free account. - Verify:
npm view <package-name> version.
Troubleshooting publish failures
404on a scoped package is not "deleted" or "wrong name." The registry returns404 ... PUT .../@scope%2fnamewhen you lack write access — it masks an auth failure. Re-checknpm whoami.EOTP(2FA enabled): add--otp=<code>to the publish command. Codes expire in ~30 seconds — ask the user for it and run publish IMMEDIATELY in the same turn, don't gather it then do other work. A repeatEOTPmeans it expired; ask for a fresh one.EPUBLISHCONFLICT: that version already exists and can't be overwritten. This usually means the local branch is behind — the version was already bumped and published on the default branch. Don't just bump again on stale history; offer to rebase onto the latest default branch first, then bump from there.- Bumped and tagged but publish failed: keep the commit and tag, fix the cause, and re-run only the publish — do not bump again.
Related Skills
LandonSchropp/plugins/ls-git/skills/git-merge-into-main
tools
VerifiedTrustedCommunity
Use when a finished, reviewed branch is committed and needs to be merged into the default branch in a repo that integrates directly to `main` (not via pull request).
1SKILL.mdUpdated Jun 9, 2026
LandonSchropp/stacked-pull-requests
tools
VerifiedTrustedCommunity
Use when working with a stack of GitHub pull requests — creating branches, keeping the stack in sync, or merging in order. Covers Git Town setup, PR targeting, rebasing, and landing the stack.
1SKILL.mdUpdated Jun 4, 2026
LandonSchropp/plugins/ls-typescript/skills/testing-bun
tools
VerifiedTrustedCommunity
Use when writing or modifying tests in a Bun project
1SKILL.mdUpdated Jun 1, 2026
LandonSchropp/plugins/ls-git/skills/merge-worktree
tools
VerifiedTrustedCommunity
Use when a finished worktree's branch has been reviewed and committed and needs to land. Rebases onto the latest default branch, then either fast-forwards it into the default branch (personal direct-to-main repos) or pushes it for a pull request (shared feature-branch repos).
1SKILL.mdUpdated Jun 1, 2026