To hand over an npm package safely, add the new maintainer with npm owner add, have them confirm access and publish a test release through your normal process, then remove your own access with npm owner rm. Do it in that order, in public, and rotate any credentials you shared.
What npm owner does
From the npm CLI documentation:
npm owner lslists every user who can modify the package and publish new versions.npm owner add USER PACKAGEmakes a user a maintainer. Added users can change metadata, publish new versions and add other owners.npm owner rm USER PACKAGEremoves a user, and the docs say this immediately revokes their privileges.- There is one access level. A user can modify the package or cannot.
- If your account uses 2FA for auth and writes, changing ownership needs a second factor step. You can supply a one time code up front with the otp option.
Because an owner can add other owners, giving someone access is a big step. Treat it like handing over keys.
Why handovers go wrong
The event-stream case is the well known warning. A maintainer handed a package to someone who offered to help, and that person later added malicious code. See event-stream in 2018, when a maintainer hands over a package. Hand over to people you have seen work, not to the first volunteer.
Steps
- Vet the person. Look at their history in the project, their other work and whether others vouch for them.
- Agree the scope. Will they own releases, security reports and the repository, or only releases?
- Check their account. They should use 2FA, ideally a hardware key. See maintainer 2FA methods ranked.
- Add them with npm owner add.
- Add them to the repository with the right role, and to the security contact list.
- Have them publish a test release or a patch through your usual pipeline.
- Move CI publishing to trusted publishing tied to the repository, so no personal token travels. See publish from CI or your laptop.
- Remove yourself with npm owner rm, once they have shipped and you have both checked.
- Post a short note in the README or an issue saying who the maintainer is now.
Credentials to rotate
| Item | Action |
|---|---|
| npm tokens you created | Revoke |
| CI secrets you added | Replace or remove |
| Repository admin access | Remove or reduce yours |
| Shared mailbox or recovery addresses | Update to the new owner |
| Signing keys | Rotate, and announce the new key |
Leaving an exit trail
Keep a short handover note: date, new owner, what was transferred, and what you removed. If you later need to prove who could publish when, this helps. See also remove a maintainer access offboarding checklist and open source maintainer succession planning.
Safeguard dependency scanning lists everything your project depends on; the free scan is at gold.safeguard.sh/scan.
Quick check
Is there a single transfer button on npm?
The owner commands add and remove users, so a handover is an add followed by a remove. Check npm's current docs for any account level transfer feature.
Should I remove myself immediately?
No. Wait until the new maintainer has published a test release and both of you have confirmed access.
Sources
Last reviewed: 19 October 2026.
