Before you start

Registry metadata, package tarballs and install-script downloads may come from different hosts.

Step by step

  1. Confirm the official npm entry point through https://docs.npmjs.com/. Never share passwords, one-time codes or recovery keys.
  2. Review signed-in devices and third-party integrations. Remove sessions you do not recognise.
  3. Enable supported multi-factor authentication or passkeys and store recovery options securely.
  4. Redact tokens, cookies, email addresses and private file links before sharing diagnostics.
  5. Review link sharing and team permissions. An IP result does not certify anonymity or account safety.

Official references

Use these provider resources for current rules. Some announcement links are help pages, not live availability tests.

Common questions

Can switching networks fix every npm error?

No. Account privileges, subscriptions, file permissions and service outages require separate checks.

What should I send to support?

Share the time, client version, redacted error code and minimal reproduction. Never share a password, token, cookie or one-time code.