nodejs/node · error · Error

npm profile set password Do not include your current or new

Error message

npm profile set password
Do not include your current or new passwords on the command line.

What it means

Thrown by the `profile set` method as a security guard when the user attempts to set the password property with an explicit value on the command line. Passwords must never be passed as CLI arguments (they would be visible in shell history, process lists, and logs). The password flow is interactive: the command prompts for the current and new password.

Source

Thrown at deps/npm/lib/commands/profile.js:184

    const readPasswords = async () => {
      const newpassword = await readUserInfo.password('New password: ')
      const confirmedpassword = await readUserInfo.password('       Again:     ')

      if (newpassword !== confirmedpassword) {
        log.warn('profile', 'Passwords do not match, please try again.')
        return readPasswords()
      }

      return newpassword
    }

    if (prop !== 'password' && value === null) {
      throw new Error('npm profile set <prop> <value>')
    }

    if (prop === 'password' && value !== null) {
      throw new Error(
        'npm profile set password\n' +
        'Do not include your current or new passwords on the command line.')
    }

    if (writableProfileKeys.indexOf(prop) === -1) {
      throw new Error(`"${prop}" is not a property we can set. ` +
        `Valid properties are: ` + writableProfileKeys.join(', '))
    }

    if (prop === 'password') {
      const current = await readUserInfo.password('Current password: ')
      const newpassword = await readPasswords()

      value = { old: current, new: newpassword }
    }

    // FIXME: Work around to not clear everything other than what we're setting
    const user = await get(conf)

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Run `npm profile set password` with NO value — it will prompt interactively
2. If automation is required, use npm's API or a token-based auth flow instead of CLI password changes
3. Rotate the password via the npm website if the CLI interactive flow is not available

Example fix

// before
npm profile set password mysecret123

// after — no value, interactive prompts follow
npm profile set password

function validatePasswordSet(prop, value) {
  if (prop === 'password' && value != null) {
    throw new Error('Do not pass password as CLI argument — use interactive mode')
  }
}

function isSafePasswordInvocation(prop, value) {
  return prop !== 'password' || value == null
}

try {
  await exec(['set', 'password'])
} catch (e) {
  if (e.message.includes('Do not include')) {
    console.error('Run: npm profile set password  (no value, follow prompts)')
  }
  throw e
}

When it happens

Trigger: Running `npm profile set password mynewpassword123` — providing a value for the password property. The code checks `if (prop === 'password' && value !== null)` and throws.

Common situations: Automating password changes via scripts and trying to pass the password inline. Copy-pasting from documentation that shows a non-interactive pattern. Accidentally including a third argument.

Related errors

• ${argv[2]} not recognized
• Unknown profile command: ${subcmd}
• npm profile set <prop> <value>
• "${prop}" is not a property we can set. Valid properties are
• The ${key} option is protected, and cannot be retrieved in t

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/e17feb895f747cc1. Report an issue: GitHub.