npm access-token pattern appears in public content
ShipReady found a non-placeholder string matching its supported npm access-token pattern in scanned page or script content.
Why it matters
A real package-registry token should be kept out of public client assets, where it can be copied without interacting with the application.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported npm_ token format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches ShipReady's supported npm token pattern.
What the evidence shows
The scanner observed a string matching its npm-specific format and stores only a redacted prefix in evidence.
Limits of this check
ShipReady does not authenticate to npm, validate the token, inspect package or organization permissions, or publish or download a package. The format match does not prove that the value is active or has publishing access.
How to fix it
Locate the public value
Trace the generated asset to its source and build configuration.
Keep confirmed tokens out of browser bundles
Remove real npm tokens from client code and use server-side secret management for publishing or automation workflows.
Review confirmed token ownership
If the value is confirmed as real, review and replace it through the account owner's npm controls.
How to verify the change
Search the deployed build
Inspect public HTML and JavaScript after deployment.
Expected: No unintended string matching the supported npm token pattern remains in public assets.