NPM-OWNER(1)

📦
version 12.2.1 · 30 versions
, in arch rolling

💅 NPM-OWNER(1) — the manual page, but make it make sense

ok so bestie, this is npm-owner, straight out of the npm manual (that's the manual name, right up top, hi 👋). It's your whole guide to who gets to touch your published package. Group-chat admin rights but for npm. Let's go 🎀

✨ NAME ✨

npm-owner — Manage package owners 🫶

Synopsis

npm owner add <user> <package-spec>
npm owner rm <user> <package-spec>
npm owner ls <package-spec>

alias: author

ok so there's also an alias, author, in case you were wondering. iykyk 💅

🌸 DESCRIPTION 🌸

Manage ownership of published packages. That's the whole vibe. Here's the breakdown, bestie:

  • ls — List all the users who have access to modify a package and push new versions. Handy when you need to know who to bug for help. Literally the "who do i @ in here" command 😭
  • add — Add a new user as a maintainer of a package. This user is enabled to modify metadata, publish new versions, and add other owners. You're basically handing them the aux cord 🔥
  • rm — Remove a user from the package owner list. This immediately revokes their privileges. no warning, no goodbye text, they're just out 💀
⚠️ real talk: there is only one level of access. Either you can modify a package, or you can't. No in-between, no "read-only era". Future versions may contain more fine-grained access levels, but that is not implemented at this time. so rn it's all or nothing, periodt.

And if you have two-factor authentication enabled with auth-and-writes (see npm help npm-profile) then you'll need to go through a second factor flow when changing ownership or include an otp on the command line with --otp. annoying? yes. keeping you safe? also yes 👑

🦋 CONFIGURATION 🦋

registry

The base URL of the npm registry. the home base, the main character, the address of where all your packages actually live 📍

otp

  • Default: null
  • Type: null or String

This is a one-time password from a two-factor authenticator. It's needed when publishing or changing package permissions with npm access.

If not set, and a registry response fails with a challenge for a one-time password, npm will prompt on the command line for one. so it'll just... ask you. politely. ✨

workspace

  • Default: (nothing — it's empty)
  • Type: String (can be set multiple times)

Enable running a command in the context of the configured workspaces of the current project while filtering by running only the workspaces defined by this configuration option. it's the "only talk to these children" switch 🧚

Valid values for the workspace config are either:

  • Workspace names
  • Path to a workspace directory
  • Path to a parent workspace directory (will result in selecting all workspaces within that folder)

When set for the npm init command, this may be set to the folder of a workspace which does not yet exist, to create the folder and set it up as a brand new workspace within the project. manifesting a workspace into existence, we love to see it 🌈

🫶 heads up: this value is not exported to the environment for child processes.

workspaces

  • Default: null
  • Type: null or Boolean

Set to true to run the command in the context of all configured workspaces. all of them. the whole squad 👯

Explicitly setting this to false will cause commands like install to ignore workspaces altogether. When not set explicitly:

  • Commands that operate on the node_modules tree (install, update, etc.) will link workspaces into the node_modules folder.
  • Commands that do other things (test, exec, publish, etc.) will operate on the root project, unless one or more workspaces are specified in the workspace config.
🫶 again: this value is not exported to the environment for child processes.

💜 SEE ALSO 💜

  • npm help "package spec"
  • npm help profile
  • npm help publish
  • npm help registry
  • npm help login

and that's the whole page, bestie, you ate that 💅✨

signing off from NPM@12.2.1, October 2026 — this page is literally NPM-OWNER(1) and it slays 🎀💖

📦 where this page comes from