Ask HN: NPM docs re. changes to auth, token management are a mess, what to do?
NPM has been bugging for some time now to update my "write-enabled granular tokens" and links me to https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
Frankly, that document is a complete communication failure. It is pure nerdview written in nerdalese. Nobody whose mother hasn't come down in the server room can possibly understand what this document intends to communicate, or what to do about it, or even whether you have to do anything about it.
They helpfully points to the NPM documentation which apparently has been updated to reflect the newest changes BUT what they link to is literally https://docs.npmjs.com/ which—unsurprisingly—gets you to the NPM documentation front page. That page has two identical lists of such existing topics as "About npm", "Getting started", "Packages and modules", "Integrations", "Organizations", "Policies", "Threats and mitigations", "npm CLI", but apparently none that is specific to the policy change and "granular writable tokens" or whatever.
I'm completely lost. How do I test whether I have to change anything? If I have to change something, what data will be affected on my side and the remote side? What tools do I have to use, can I use a web address or should I use the npm (or pnpm) CLI tools? What will I have to do in the future? Will I have to go through the procedure every 30 days looking forward? What are the consequences if I miss a date, can I somehow revert?
None of these simple, obvious and important questions is apparently covered in any way by the pages that I was made to click through to. All I know now that have to worry about grainy write tokens. Sorry I don’t have an answer except to commiserate with you that for such shitware npm is surprisingly resilient and the docs are almost intentionally designed to piss you off and I think were written by a maniac. FWIW npm was my savior coming from Python back in the day, but I agree that some of its design decisions do look, shall we say, more problematic now than they used to.