Claude Code can run npm publish during a refactoring session, pushing half-finished code to the public npm registry. In Auto Mode, there's no confirmation prompt.
The npm-publish-guard hook (included by default in cc-safe-setup) blocks a publish command that begins the command string:
It is anchored to the start. Its pattern is ^\s*(npm\s+publish|npx\s+npm\s+publish), so cd pkg && npm publish goes past it — the hook is never asked about the part after the separator. Run --blindspots to see how much of your own history arrives in that shape.
# Blocks: npm publish, npm publish --tag, yarn publish, pnpm publish
npx github:yurukusa/cc-safe-setupAlso blocks: cargo publish, gem push, twine upload, pip publish. Each has a dedicated guard hook.
The hook allows npm publish --dry-run — you can test without actually publishing.
| Ecosystem | Hook | Blocks |
|---|---|---|
| npm/yarn/pnpm | npm-publish-guard | npm publish |
| Rust | cargo-publish-guard | cargo publish |
| Python | pip-publish-guard | twine upload |
| Ruby | gem-push-guard | gem push |
| PHP | composer-guard | composer global require |
npx github:yurukusa/cc-safe-setupnpm-publish-guard included by default. 900+ example hooks total.
cc-safe-setup · GitHub