如何在客户端通过npm配置启用publish并禁用unpublish相关命令？

Great question! Let's break down what's possible for your use case:

1. Native npm Client Limitation #

First off, there is no built-in npm client configuration that directly disables npm unpublish (including the --force flag) while keeping npm publish enabled. npm's client-side settings don't include granular controls for blocking specific commands like this out of the box.

2. Recommended: Control via Verdaccio (Private Repository) #

Since you're using Verdaccio, this is the most reliable way to enforce unpublish restrictions—because even if someone tries to run the command locally, the repository will reject it. Here's how you can configure it today:

In your Verdaccio config.yaml file, define package-specific permissions to restrict unpublish access to only trusted users (or disable it entirely for all users):

packages:
  '@your-scope/*':
    access: $all
    publish: $authenticated
    unpublish: $admin  # Only allow admins to unpublish; set to "" to block all users
  '**':
    access: $all
    publish: $authenticated
    unpublish: ""  # Block unpublish for all public packages in your repo

This way, any client attempt to run npm unpublish will get a permission error from Verdaccio, regardless of local client settings.

3. Client-Side Workarounds (For Local Enforcement) #

If you need additional safeguards on the client side (for example, to prevent accidental runs), here are a couple of practical options:

a. Shell Alias to Block the Command #

Add an alias to your shell configuration file (.bashrc, .zshrc, or equivalent) to intercept npm unpublish commands:

alias npm='function _npm() {
  if [[ "$1" == "unpublish" ]]; then
    echo "❌ Error: npm unpublish is disabled on this system!"
    return 1
  else
    command npm "$@"
  fi
}; _npm'

After reloading your shell, running npm unpublish will immediately fail with an error message, while all other npm commands work as normal.

b. Package Script Hook (Per-Package) #

For individual packages you maintain, add a preunpublish script to the package.json that exits with an error:

{
  "scripts": {
    "preunpublish": "echo '❌ Unpublish is disabled for this package!' && exit 1"
  }
}

This will trigger automatically whenever someone tries to run npm unpublish for that package, stopping the process before it even reaches the repository.

Summary #

While the npm client doesn't have native support for disabling npm unpublish, combining Verdaccio's permission controls (the most robust solution) with client-side workarounds will give you the restriction you need.

内容的提问来源于stack exchange，提问作者Deunz