NPM-HOOK(1)

💖 NPM-HOOK 💖

hiii bestie 🫶 welcome to the npm-hook manual page (that's section 1 of the manual, for the npm hook command, iykyk). this is the whole entire page, every option, every flag, every default, nothing skipped, nothing summarised. we're doing this properly. periodt. 💅

---

✨ SYNOPSIS ✨

npm hook add <pkg> <url> <secret> [--type=<type>]
npm hook ls [pkg]
npm hook rm <id>
npm hook update <id> <url> <secret>

🚨 okay important: this command is unaware of workspaces. like, it genuinely does not know they exist. no cap. don't come for me, that's just what it says.

---

🌸 DESCRIPTION 🌸

so basically this command lets you manage npm hooks, including adding, removing, listing, and updating them. iconic behaviour fr fr.

and what even is a hook? a hook lets you configure URL endpoints that get notified whenever a change happens to any of the supported entity types. and there are exactly three different types of entities that hooks can watch:

• packages 📦
• owners 👑
• scopes 🌀

here's how you make each one:

• to create a package hook, simply reference the package name. easy.
• to create an owner hook, prefix the owner name with ~ (as in, ~youruser). yes, the little squiggle. it's giving tilde.
• to create a scope hook, prefix the scope name with @ (as in, @yourscope). the at-sign, slay.

and for the hooks you already have? the hook id used by update and rm is the ID listed in npm hook ls for that particular hook. so go run ls first, bestie, don't just guess an id out of thin air 😭

also the shared secret gets sent along to the URL endpoint, so you can verify the request actually came from your own configured hook. it's your lil signature. your proof of vibe. ✨

---

🦋 EXAMPLE 🦋

add a hook to watch a package for changes:

$ npm hook add lodash https://example.com/ my-shared-secret

add a hook to watch packages belonging to the user substack:

$ npm hook add ~substack https://example.com/ my-shared-secret

add a hook to watch packages in the scope @npm:

$ npm hook add @npm https://example.com/ my-shared-secret

list all your active hooks:

$ npm hook ls

list your active hooks for the lodash package:

$ npm hook ls lodash

update an existing hook's url:

$ npm hook update id-deadbeef https://my-new-website.here/

remove a hook:

$ npm hook rm id-deadbeef

---

🌈 CONFIGURATION 🌈

registry

• Default: "https://registry.npmjs.org/"
• Type: URL

the base URL of the npm registry. that's the one. 🏠

otp

• Default: null
• Type: null or String

this is a one-time password from a two-factor authenticator. it's needed when publishing or changing package permissions with npm access.

if it's not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one. so like, it'll just ask you. mid-command. very main character of it. 💅

---

🧚 SEE ALSO 🧚

• "Introducing Hooks" blog post — https://blog.npmjs.org/post/145260155635/introducing-hooks-get-notifications-of-npm

---

and that's the whole page, bestie, you ate that 🍓 this was NPM@10.9.8, dated March 2026, page NPM-HOOK(1). go forth and hook responsibly 💖✨