# libnpmpublish > Programmatic API for the bits behind npm publish and unpublish Latest version **12.0.0** (published 2026-07-08) · ISC license · 0 weekly downloads ## Install ```sh npm install libnpmpublish pnpm add libnpmpublish yarn add libnpmpublish bun add libnpmpublish ``` ## Health **Score 68/100 (B)** — status: active. Positive: has types package; no vulnerabilities; recently updated; high maintenance score; high quality score; popular repo. Warnings: low downloads; no esm support. ## Facts | | | |---|---| | Version | 12.0.0 | | Published | 2026-07-08 | | First published | 2018-08-31 | | Weekly downloads | 0 | | License | ISC | | TypeScript types | separate (@types/libnpmpublish) | | Module format | CommonJS | | Node | ^22.22.2 \|\| ^24.15.0 \|\| >=26.0.0 | | Dependencies | 8 | | Unpacked size | 28.1 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 10111 | | Author | GitHub Inc. | | Maintainers | saquibkhan, npm-cli-ops, reggi | ## Links - npm: https://www.npmjs.com/package/libnpmpublish - Repository: https://github.com/npm/cli - Homepage: https://npmjs.com/package/libnpmpublish - Issues: https://github.com/npm/cli/issues - npm.io page: https://npm.io/package/libnpmpublish ## Dependencies (8) - [ssri](https://npm.io/package/ssri.md) ^14.0.0 - [semver](https://npm.io/package/semver.md) ^7.3.7 - [ci-info](https://npm.io/package/ci-info.md) ^4.0.0 - [proc-log](https://npm.io/package/proc-log.md) ^7.0.0 - [sigstore](https://npm.io/package/sigstore.md) ^5.0.0 - [npm-package-arg](https://npm.io/package/npm-package-arg.md) ^14.0.0 - [npm-registry-fetch](https://npm.io/package/npm-registry-fetch.md) ^20.0.1 - [@npmcli/package-json](https://npm.io/package/@npmcli/package-json.md) ^8.0.0 ## Recent versions - 12.0.0 (latest) — 2026-07-08 - 12.0.0-pre.0 (prerelease) — 2026-06-19 - 10.0.2 (backport) — 2026-03-04 - 11.2.0-pre.0.0 — 2026-05-20 - 11.2.0 — 2026-05-20 - 11.1.3 — 2025-11-19 - 11.1.2 — 2025-10-08 - 11.1.1 — 2025-09-24 - 11.1.0 — 2025-07-24 - 11.0.1 — 2025-06-12 - 11.0.0 — 2024-12-16 - 11.0.0-pre.0 — 2024-11-26 - 10.0.1 — 2024-11-21 - 10.0.0 — 2024-10-03 - 9.0.9 — 2024-05-29 - … 56 more at https://npm.io/package/libnpmpublish/versions ## README # libnpmpublish [![npm version](https://img.shields.io/npm/v/libnpmpublish.svg)](https://npm.im/libnpmpublish) [![license](https://img.shields.io/npm/l/libnpmpublish.svg)](https://npm.im/libnpmpublish) [![CI - libnpmpublish](https://github.com/npm/cli/actions/workflows/ci-libnpmpublish.yml/badge.svg)](https://github.com/npm/cli/actions/workflows/ci-libnpmpublish.yml) [`libnpmpublish`](https://github.com/npm/libnpmpublish) is a Node.js library for programmatically publishing and unpublishing npm packages. Give it a manifest as an object and a tarball as a Buffer, and it'll put them on the registry for you. ## Table of Contents * [Example](#example) * [Install](#install) * [API](#api) * [publish/unpublish opts](#opts) * [`publish()`](#publish) * [`unpublish()`](#unpublish) ## Example ```js const { publish, unpublish } = require('libnpmpublish') ``` ## Install `$ npm install libnpmpublish` ### API #### `opts` for `libnpmpublish` commands `libnpmpublish` uses [`npm-registry-fetch`](https://npm.im/npm-registry-fetch). Most options are passed through directly to that library, so please refer to [its own `opts` documentation](http://npm.im/npm-registry-fetch#fetch-options) for options that can be passed in. A couple of options of note: * `opts.defaultTag` - registers the published package with the given tag, defaults to `latest`. * `opts.access` - tells the registry whether this package should be published as `'public'` or `'restricted'`. May also be `null`, which preserves the existing access level on already-published packages and defers to the registry's default for new packages (the registry treats scoped packages as `restricted` and unscoped packages as `public` by default). Only `'restricted'` and `null` are meaningful for scoped packages; `'restricted'` is rejected for unscoped packages. Defaults to `null`. * `opts.token` - can be passed in and will be used as the authentication token for the registry. For other ways to pass in auth details, see the n-r-f docs. * `opts.provenance` - when running in a supported CI environment, will trigger the generation of a signed provenance statement to be published alongside the package. Mutually exclusive with the `provenanceFile` option. * `opts.provenanceFile` - specifies the path to an externally-generated provenance statement to be published alongside the package. Mutually exclusive with the `provenance` option. The specified file should be a [Sigstore Bundle](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) containing a [DSSE](https://github.com/secure-systems-lab/dsse)-packaged provenance statement. * `opts.stage` - when `true`, publishes the package to a staging area instead of making it immediately available. The registry response will include a `stageId` (UUID) that can be used to approve or reject the staged version later. Changes the request method to `POST` and the endpoint to `/-/stage/package/`. The returned Response object will have a `stageId` property. #### `> libpub.publish(manifest, tarData, [opts]) -> Promise` Sends the package represented by the `manifest` and `tarData` to the configured registry. `manifest` should be the parsed `package.json` for the package being published (which can also be the manifest pulled from a packument, a git repo, tarball, etc.) `tarData` is a `Buffer` of the tarball being published. If `opts.npmVersion` is passed in, it will be used as the `_npmVersion` field in the outgoing packument. You may put your own user-agent string in there to identify your publishes. If `opts.algorithms` is passed in, it should be an array of hashing algorithms to generate `integrity` hashes for. The default is `['sha512']`, which means you end up with `dist.integrity = 'sha512-deadbeefbadc0ffee'`. Any algorithm supported by your current node version is allowed -- npm clients that do not support those algorithms will simply ignore the unsupported hashes. ##### Example ```js // note that pacote.manifest() and pacote.tarball() can also take // any spec that npm can install. a folder shown here, since that's // far and away the most common use case. const path = '/a/path/to/your/source/code' const pacote = require('pacote') // see: http://npm.im/pacote const manifest = await pacote.manifest(path) const tarData = await pacote.tarball(path) await libpub.publish(manifest, tarData, { npmVersion: 'my-pub-script@1.0.2', token: 'my-auth-token-here' }, opts) // Package has been published to the npm registry. ``` #### `> libpub.unpublish(spec, [opts]) -> Promise` Unpublishes `spec` from the appropriate registry. The registry in question may have its own limitations on unpublishing. `spec` should be either a string, or a valid [`npm-package-arg`](https://npm.im/npm-package-arg) parsed spec object. For legacy compatibility reasons, only `tag` and `version` specs will work as expected. `range` specs will fail silently in most cases. ##### Example ```js await libpub.unpublish('lodash', { token: 'i-am-the-worst'}) // // `lodash` has now been unpublished, along with all its versions ``` --- _Source: https://npm.io/package/libnpmpublish · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._