diff --git a/lib/publish.js b/lib/publish.js
index ecf593a..1fcc531 100644
--- a/lib/publish.js
+++ b/lib/publish.js
@@ -7,6 +7,7 @@ var assert = require('assert')
 var fixer = require('normalize-package-data').fixer
 var concat = require('concat-stream')
 var ssri = require('ssri')
+var clone = require('clone')
 
 function escaped (name) {
   return name.replace('/', '%2f')
@@ -75,7 +76,7 @@ function putFirst (registry, data, tarbuffer, access, auth, cb) {
 
   if (!auth.token) {
     root.maintainers = [{ name: auth.username, email: auth.email }]
-    data.maintainers = JSON.parse(JSON.stringify(root.maintainers))
+    data.maintainers = clone(root.maintainers)
   }
 
   root.versions[ data.version ] = data
@@ -173,8 +174,7 @@ function putNext (registry, newVersion, root, current, auth, cb) {
         current[i] = root[i]
     }
   }
-  var maint = JSON.parse(JSON.stringify(root.maintainers))
-  root.versions[newVersion].maintainers = maint
+  root.versions[newVersion].maintainers = clone(root.maintainers)
 
   var uri = url.resolve(registry, escaped(root.name))
   var options = {
diff --git a/package.json b/package.json
index c5cfa56..ead6e3d 100644
--- a/package.json
+++ b/package.json
@@ -15,6 +15,7 @@
     "index.js"
   ],
   "dependencies": {
+    "clone": "^1.0.2",
     "concat-stream": "^1.5.2",
     "graceful-fs": "^4.1.6",
     "normalize-package-data": "~1.0.1 || ^2.0.0",
diff --git a/test/publish.js b/test/publish.js
index cb2a7a1..2f862f3 100644
--- a/test/publish.js
+++ b/test/publish.js
@@ -8,6 +8,7 @@ var ssri = require('ssri')
 var server = require('./lib/server.js')
 var common = require('./lib/common.js')
 var client = common.freshClient()
+var clone = require('clone')
 
 function nop () {}
 
@@ -145,7 +146,7 @@ test('publish call contract', function (t) {
   )
 
   t.test('malformed semver in publish', function (t) {
-    var metadata = JSON.parse(JSON.stringify(METADATA))
+    var metadata = clone(METADATA)
     metadata.version = '%!@#$'
     var params = {
       metadata: metadata,