npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

▤ Summary

GitHub announced staged publishing for npm as generally available, requiring a human maintainer to pass a 2FA challenge to approve package versions before they become installable. The feature uploads prebuilt tarballs to a staging queue rather than publishing immediately, and it supports CI/CD and OIDC trusted publishing while enforcing 'proof of presence.' GitHub also introduced three install-source flags (--allow-file, --allow-remote, --allow-directory) to control non-registry install sources and enable explicit allowlisting. The updates aim to harden the npm supply chain against rising package-poisoning attacks and GitHub recommends pairing staged publishing with OIDC and updating to npm CLI 11.15.0+ to use the new workflow.

▦ Linked Companies