Security
npm's Staged Publishing Adds Friction Against Supply Chain Attacks
A new approval workflow lets maintainers review packages before they go live, adding a human gate between CI pipelines and package consumers.
InfoQ
npm has rolled out staged publishing to all users, introducing an explicit review and approval checkpoint before published versions become downloadable to the broader ecosystem.
How it works#
Instead of publishing directly to the registry, maintainers now upload a prebuilt package to a staging queue visible both on npmjs.com and via the command line. An authorized team member must then authenticate with two-factor authentication to formally release the version. The initial upload doesn't require 2FA—allowing non-interactive CI systems to remain unaffected—while the approval step ensures human presence at the gate.
The feature requires npm CLI 11.15.0 or newer and Node 22.14.0 or higher for packages already registered on the registry. The approval workflow uses simple subcommands:
npm stage publish— submit a version to the queuenpm stage list— view pending staged versionsnpm stage view <stage-id>— inspect the tarball contentsnpm stage approve <stage-id>— promote to the registry with 2FAnpm stage reject <stage-id>— discard a staged version
Integration with trusted publishing#
GitHub recommends pairing staging with trusted publishing via OpenID Connect, where CI configurations can be restricted to stage-only permissions—preventing direct npm publish commands entirely. Existing bulk trusted publishing setups can be reused; teams simply update their CI tooling and swap the publish command.
The feature also introduces new install-time controls: --allow-file, --allow-remote, and --allow-directory alongside the existing --allow-git. Each accepts all or none and can be configured in .npmrc or package.json. The --allow-git setting will default to none in v12.
Why it matters#
The ecosystem has weathered repeated supply chain incidents—malicious worm campaigns and troubled migrations from legacy token formats. Security researcher Adnan Khan posted on X that "everyone publishing to NPM should turn this feature on today," emphasizing the defense: "Publish from CI via OIDC then approve the package before it goes live for everyone."
