August 7, 2026•1 min read•from InfoQ

npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags.

By Daniel Curtis

Want to read more?

Check out the full article on the original site

View original article→

Tagged with

#npm

#Node.js

#staged publishing

#package publishing

#maintainer approval

#version control

#two-factor authentication

#supply chain security

#security

#npm CLI

#Node

#permission flags

#queueing

#release management

#package versions

#authentication

#configurable

#Node 22.14.0

#npm 11.15.0

#package manager