{"record":{"id":"e17feb895f747cc1","repo":"nodejs/node","slug":"npm-profile-set-password-do-not-include-your-curre","errorCode":null,"errorMessage":"npm profile set password\nDo not include your current or new passwords on the command line.","messagePattern":"npm profile set password\nDo not include your current or new passwords on the command line\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"deps/npm/lib/commands/profile.js","lineNumber":184,"sourceCode":"\n    const readPasswords = async () => {\n      const newpassword = await readUserInfo.password('New password: ')\n      const confirmedpassword = await readUserInfo.password('       Again:     ')\n\n      if (newpassword !== confirmedpassword) {\n        log.warn('profile', 'Passwords do not match, please try again.')\n        return readPasswords()\n      }\n\n      return newpassword\n    }\n\n    if (prop !== 'password' && value === null) {\n      throw new Error('npm profile set <prop> <value>')\n    }\n\n    if (prop === 'password' && value !== null) {\n      throw new Error(\n        'npm profile set password\\n' +\n        'Do not include your current or new passwords on the command line.')\n    }\n\n    if (writableProfileKeys.indexOf(prop) === -1) {\n      throw new Error(`\"${prop}\" is not a property we can set. ` +\n        `Valid properties are: ` + writableProfileKeys.join(', '))\n    }\n\n    if (prop === 'password') {\n      const current = await readUserInfo.password('Current password: ')\n      const newpassword = await readPasswords()\n\n      value = { old: current, new: newpassword }\n    }\n\n    // FIXME: Work around to not clear everything other than what we're setting\n    const user = await get(conf)","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/commands/profile.js#L166-L202","documentation":"Thrown by the `profile set` method as a security guard when the user attempts to set the password property with an explicit value on the command line. Passwords must never be passed as CLI arguments (they would be visible in shell history, process lists, and logs). The password flow is interactive: the command prompts for the current and new password.","triggerScenarios":"Running `npm profile set password mynewpassword123` — providing a value for the password property. The code checks `if (prop === 'password' && value !== null)` and throws.","commonSituations":"Automating password changes via scripts and trying to pass the password inline. Copy-pasting from documentation that shows a non-interactive pattern. Accidentally including a third argument.","solutions":["Run `npm profile set password` with NO value — it will prompt interactively","If automation is required, use npm's API or a token-based auth flow instead of CLI password changes","Rotate the password via the npm website if the CLI interactive flow is not available"],"exampleFix":"// before\nnpm profile set password mysecret123\n\n// after — no value, interactive prompts follow\nnpm profile set password","handlingStrategy":"validation","validationCode":"function validatePasswordSet(prop, value) {\n  if (prop === 'password' && value != null) {\n    throw new Error('Do not pass password as CLI argument — use interactive mode')\n  }\n}","typeGuard":"function isSafePasswordInvocation(prop, value) {\n  return prop !== 'password' || value == null\n}","tryCatchPattern":"try {\n  await exec(['set', 'password'])\n} catch (e) {\n  if (e.message.includes('Do not include')) {\n    console.error('Run: npm profile set password  (no value, follow prompts)')\n  }\n  throw e\n}","preventionTips":["Never pass passwords on the command line — they are recorded in shell history and process lists","Run npm profile set password with NO value to use interactive prompts","For automation, use npm tokens or API keys instead of password-based flows"],"tags":["npm","profile","security","password","cli"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}