npm (@npmjs.com) · Mythryl

github.blogStage-only npm tokens for safer automation - GitHub ChangelogYou can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token…

Automate preparation, keep approval with a maintainer. npm’s stage-only granular access tokens let CI stage new versions, while publication requires maintainer approval with 2FA. Get started ⬇️

github.blognpm extends recovery-code security holds to all accounts - GitHub Changelognpm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change appli...

The latest updates on npm 🧵⬇️

npm now has broader account protection. A temporary 72-hour security hold will be placed on any account after a successful recovery-code sign-in. Applicable to all npm accounts.

github.comnpm’s roadmap: safer publishing, smoother workflows, and what’s next · community · Discussion #208130Hi everyone, Leo here, npm's PM. I want to share what we’ve shipped since May, where we’re focusing for the rest of 2026, and what we’re considering for 2027. I also want your feedback: what would ...

Learn more recent improvements and what’s next. Tell us what would make publishing and consuming packages safer and easier.

The latest updates on npm 🧵⬇️

github.blogMultiple trusted publishing configurations for npm - GitHub ChangelogWe’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing config...

npm is making safer publishing easier to adopt. Now generally available: • Multiple trusted publishing configurations per package • Staged packages can only be approved after malware scanning is complete • Maintainers can see their staged history in the package versions tab

github.blogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…

13 Aug

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/20...

13 Aug

Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.

docs.npmjs.comTrusted publishing for npm packages | npm DocsDocumentation for the npm registry, website, and command-line interface

4 Aug

npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing. docs.npmjs.com/trusted-publ...

gh.ionpm publish-time malware scanning and dual-use metadata - GitHub ChangelogAs part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

29 July

Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default. gh.io/npm-publish-...