Fix publish hanging indefinitely

Adds stdin inheritance and timeout to prevent publish from hanging when:
- npm/yarn prompts for authentication or OTP
- Lifecycle scripts run in watch mode
- Other unexpected blocking conditions occur

The timeout (3 minutes) matches git network operations timeout.

Fixes #312

Author: sindresorhus

readme.md

@@ -337,6 +337,59 @@ npm ERR! 403 Forbidden - GET https://registry.yarnpkg.com/-/package/my-awesome-p
 }
 ```
 
+### np hangs during the "Publishing package" step
+
+If `np` hangs indefinitely during publishing, common causes include:
+
+**Lifecycle scripts that don't exit**
+
+npm automatically runs lifecycle hooks like `prepublish`, `publish`, and `postpublish` during publishing. If these scripts don't exit (e.g., running in watch mode), `np` will hang.
+
+```json
+{
+	"scripts": {
+		"test": "vitest",
+		"publish": "npm run test && np"
+	}
+}
+```
+
+**Solution**: Don't name your scripts `publish`, `prepublish`, or `postpublish` (these are reserved npm lifecycle hooks). Use names like `release` instead:
+
+```json
+{
+	"scripts": {
+		"test": "vitest run",
+		"release": "np"
+	}
+}
+```
+
+**Tests running in watch mode**
+
+If your test script runs in watch mode, it won't exit after running tests.
+
+**Solution**: Ensure your test command exits after running:
+
+```json
+{
+	"scripts": {
+		"test": "vitest run",
+		"test:dev": "vitest"
+	}
+}
+```
+
+**Registry configuration issues**
+
+A missing trailing slash in `.npmrc` registry configuration can cause hangs.
+
+**Solution**: Ensure registry URLs have a trailing slash:
+
+```npmrc
+@ORG:registry=https://npm.pkg.github.com/
+```
+
 ## Maintainers
 
 - [Sindre Sorhus](https://github.com/sindresorhus)

source/npm/publish.js

@@ -18,8 +18,17 @@ export const getPackagePublishArguments = options => {
 	return arguments_;
 };
 
+// 3 minutes timeout for publish operations (like git network operations)
+// Publishing can take time for large packages or slow connections
+const publishTimeout = 180_000;
+
 export function runPublish(arguments_, options = {}) {
-	const execaOptions = {};
+	const execaOptions = {
+		// Inherit stdin to allow password/OTP prompts from npm/yarn
+		stdin: 'inherit',
+		// Timeout to prevent infinite hangs (e.g., from lifecycle scripts in watch mode)
+		timeout: publishTimeout,
+	};
 
 	// `npm` 8.5+ has a bug where `npm publish <folder>` publishes from cwd instead of <folder>.
 	// We work around this by changing cwd to the target directory.
@@ -28,14 +37,5 @@ export function runPublish(arguments_, options = {}) {
 		execaOptions.cwd = options.cwd;
 	}
 
-	const cp = execa(...arguments_, execaOptions);
-
-	cp.stdout.on('data', chunk => {
-		// https://github.com/yarnpkg/berry/blob/a3e5695186f2aec3a68810acafc6c9b1e45191da/packages/plugin-npm/sources/npmHttpUtils.ts#L541
-		if (chunk.toString('utf8').includes('One-time password:')) {
-			cp.kill();
-		}
-	});
-
-	return cp;
+	return execa(...arguments_, execaOptions);
 }

test/npm/publish.js

@@ -33,3 +33,10 @@ test('runPublish uses cwd option when provided', async t => {
 	const result = await runPublish(['echo', ['test']], {cwd: '/tmp'});
 	t.is(result.cwd, '/tmp');
 });
+
+test('runPublish sets stdin to inherit and includes timeout', async t => {
+	const result = runPublish(['echo', ['test']]);
+	t.not(result, undefined);
+	// Process should complete successfully with our default options
+	await t.notThrowsAsync(result);
+});