Package publish token passed as CLI argument (log-visible)
Part of the Release & branch safety check · fix arrives as a pull request
What it is
A registry token is interpolated onto a command line in a workflow step — passed as a CLI argument rather than through the environment.
Why it matters
Command lines are echoed into workflow logs and are visible in process listings on the runner. GitHub's log masking does not reliably cover a token embedded in a longer command string.
How to fix it
Set it as an environment variable the tool reads — NODE_AUTH_TOKEN for npm, configured via npm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }} in a run: step — and rotate the current one, since previous runs have already logged it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.