Lost or reimaged laptop: which package manager credentials to revoke?

Revoke anything that lets someone publish or push first: npm tokens, Git tokens, container registry logins and cloud keys. Then rotate read access. Work from a second device, because the laptop is untrusted. Treat every credential stored in plain files on that machine as exposed, even if the disk was encrypted.

Start with what can change production

Order by blast radius, not by convenience:

1. Publish and push rights. Tokens that can release a package, push to a repository or push an image. A stolen publish token lets an attacker ship code that your users install.
2. Cloud and deployment credentials. Anything the laptop used to reach infrastructure.
3. Read-only tokens. Still rotate, because they can expose private code and may reveal other secrets.
4. Sessions. Sign out of web sessions and revoke remembered devices.

Where package manager credentials hide

Based on the vendor documentation:

• npm: Access tokens. The npm documentation says only granular tokens are supported now, and you can view and revoke tokens from the web or the CLI. Check your user and project npmrc files for auth lines.
• Git: The credential helper decides where tokens sit. The Git documentation says the store helper keeps credentials indefinitely on disk. Keychain helpers hold them in the operating system store.
• Docker: Without a credential store, Docker keeps logins in config.json in your Docker config folder, base64 encoded, which the documentation says is less secure than a store.
• Everything else: Shell history, env files, editor settings and anything synced from a dotfiles repository.

A response sequence

1. From a clean device, sign in to each service and list active tokens.
2. Revoke every token created for or used on the lost laptop. If you cannot tell which, revoke all of them and issue new ones.
3. Create replacements with narrow scope and an expiry. For npm, the documentation lets you restrict packages, set an expiration and limit by IP range.
4. Review recent activity: publishes, pushes, new collaborators and new tokens.
5. If an unexpected package version or image tag appears, treat it as an incident, and ask your team and affected users to hold off on that version.
6. Record what you rotated and when.

Reimaging is not enough

Wiping a laptop does not revoke anything. Tokens live on the services, so a copy taken before the wipe still works. Rotation is the control, the reimage is cleanup.

Make the next one easier

Keep a list of which tokens exist and where each is used. Prefer short expiry, so forgotten tokens stop working on their own. Keep credentials in a keychain, not in dotfiles. Practice the rotation once before you need it.

An accurate inventory of what your projects depend on and what runs in CI also helps you judge exposure quickly, because you know which packages the stolen credentials could have changed.

If you want a quick look at what your projects actually resolve, Safeguard offers SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• npm, About access tokens
• Git, gitcredentials documentation
• Docker login documentation

Last reviewed: 19 October 2026.