HackerNews中文版

NPM 已经提示我一段时间要更新我的“可写细粒度令牌”，并链接到 https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/ 坦白说，这份文档完全是一场沟通的失败。它纯粹是用“极客语”写成的“极客视角”。除了在服务器机房里长大的技术人员，没有人能理解这份文档想表达什么，或者应该怎么做，甚至不知道是否需要采取任何行动。他们很贴心地指向了 NPM 文档，该文档显然已经更新以反映最新的变化，但他们链接到的实际上是 https://docs.npmjs.com/，这——不出所料——把你带到了 NPM 文档首页。该页面有两个相同的列表，列出了诸如“关于 npm”、“入门”、“包和模块”、“集成”、“组织”、“策略”、“威胁和缓解”、“npm CLI”等主题，但显然没有任何内容是专门针对策略更改和“细粒度可写令牌”之类的。我完全迷失了。我如何测试我是否需要更改任何内容？如果我必须更改某些内容，我的端和远程端的数据会受到什么影响？我需要使用什么工具，可以使用网址还是应该使用 npm（或 pnpm）CLI 工具？我将来需要做什么？我是否需要每 30 天重复这个流程？如果我错过了截止日期，会有什么后果，我能以某种方式恢复吗？这些简单、显而易见且重要的问题，显然在任何我被引导点击的页面中都没有涉及。我现在只知道我需要担心细粒度的可写令牌。

查看原文

NPM has been bugging for some time now to update my "write-enabled granular tokens" and links me to https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/<p>Frankly, that document is a complete communication failure. It is pure nerdview written in nerdalese. Nobody whose mother hasn't come down in the server room can possibly understand what this document intends to communicate, or what to do about it, or even whether you have to do anything about it.<p>They helpfully points to the NPM documentation which apparently has been updated to reflect the newest changes BUT what they link to is literally https://docs.npmjs.com/ which—unsurprisingly—gets you to the NPM documentation front page. That page has two identical lists of such existing topics as "About npm", "Getting started", "Packages and modules", "Integrations", "Organizations", "Policies", "Threats and mitigations", "npm CLI", but apparently none that is specific to the policy change and "granular writable tokens" or whatever.<p>I'm completely lost. How do I test whether I have to change anything? If I have to change something, what data will be affected on my side and the remote side? What tools do I have to use, can I use a web address or should I use the npm (or pnpm) CLI tools? What will I have to do in the future? Will I have to go through the procedure every 30 days looking forward? What are the consequences if I miss a date, can I somehow revert?<p>None of these simple, obvious and important questions is apparently covered in any way by the pages that I was made to click through to. All I know now that have to worry about grainy write tokens.

Ask HN: NPM 文档关于身份验证和令牌管理的变更一团糟，该怎么办？