brew package intelligence

node@18

Automic Vault tracks node@18 because plain text publishing token matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about node@18

Open-source, cross-platform JavaScript runtime environment

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text Publishing Token

`npm publish` commonly relies on an auth token stored in ~/.npmrc. Our isotope stores that token in the macOS keychain and injects it only when `npm publish` runs.

Local README excerpt

Node 18 Radioisotope

This radioisotope modifies the Homebrew node@18 package, but only changes the installed npm launcher. node and npx continue to run without isotope credential injection.

Security Model

Plaintext npm publishing tokens are commonly stored in ~/.npmrc as _authToken entries. The migration stores one token in the Automic Vault isotope keychain as NODE_AUTH_TOKEN and rewrites matching npm config entries to reference ${NODE_AUTH_TOKEN}.

The post-install hook wraps /opt/node@18/bin/npm. The wrapper injects NODE_AUTH_TOKEN only when an npm publish invocation is detected, then execs the original npm launcher.

Caveats

Only one npm publishing token is supported.
Multiple distinct _authToken values fail migration and must be handled

manually.

Project-level npm configs are not migrated; only the npm user config is

inspected.

Source: data/radioisotopes/node@18/README.md

Coverage source

https://formulae.brew.sh/formula/node@18

Caveats

We currently support one npm publishing token.
Existing npm config entries are rewritten to reference NODE_AUTH_TOKEN.

install metadata

Resolver facts

Package key	brew:node@18
Last updated	2026-02-21T17:34:36-05:00
Pulse	updated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

Nucleus package database
local isotope README
radioisotope security manifest