Post

Days since forgetting to approve a staged package: 0

Do you want to try out drydock.org? It will show you the diff of the staged package and send you an email when it's done all threat controls

drydock.orgDrydock: pre-publish package reviewDrydock lets npm, PyPI, and VS Code maintainers review the exact package artifact before an npm stage publish or gated release goes live.

Lars

@webpro.nl

4 Aug

Can I use it in a publish workflow from my local machine?

Jovi 🐨

@jovidecroock.com

4 Aug

No, it automatically picks up either GitHub gated workflow environments or tarballs that are staged

Lars

@webpro.nl

Thanks. Maybe I need to build something into release-it for this. Any chance you could point me to npm docs re. this? Or is that one of your product USPs? 😬 Product idea: offer hooks or something for other notification mechanisms.

4/8/26, 8:19 am0 reposts2 likes

Jovi 🐨

@jovidecroock.com

4 Aug

Yea, should add webhooks. slack and email currently, it’s not really a product but I haven’t gotten to open sourcing it just yet. will forward docs when I get home

Jovi 🐨

@jovidecroock.com

4 Aug

api-docs.npmjs.com#tag/Stage/op... I poll this

api-docs.npmjs.comnpm Registry API