diff --git a/.drone.yml b/.drone.yml
index 7c26b16..ba6dc6b 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2,6 +2,12 @@ kind: pipeline
 type: docker
 name: default
 
+when:
+  event:
+  - push
+  - pull_request
+  - tag
+
 steps:
 
 - name: build (rust)
@@ -13,9 +19,18 @@ steps:
 
 - name: build (node)
   image: node:22.9-bookworm
+  environment:
+    NPM_TOKEN:
+      from_secret: NPM_TOKEN
   commands:
   - corepack enable
   - cd um_wasm_loader
   - pnpm i
   - BUILD_SKIP_WASM_PACK=1 pnpm build
   - pnpm pack
+  - |
+    if [ -n "${DRONE_TAG}" ]; then
+      ./ci_publish.sh
+    else
+      echo "skip package publish"
+    fi
diff --git a/um_wasm_loader/ci_publish.sh b/um_wasm_loader/ci_publish.sh
new file mode 100644
index 0000000..6c4fea9
--- /dev/null
+++ b/um_wasm_loader/ci_publish.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo '//git.unlock-music.dev/api/packages/um/npm/:_authToken=${NPM_TOKEN}' > $HOME/.npmrc
+pnpm publish --access=public