npm
@npmjs

The package manager for JavaScript Problems? Visit npmjs.com/support or github.com/npm/feedback

npmjs.com/
Joined June 2011
1,007 Photos and videos
Manage npm dist-tags with Trusted Publishing, without keeping a separate token for the job. Opt in per configuration, including staging-only workflows. Existing permissions stay unchanged unless you enable it. Learn more ⬇️ github.blog/changelog/2026-0…

Opt-in dist-tag permissions for npm trusted publishing - GitHub Changelog

Trusted publishing configurations for npm can now be granted permission to manage dist-tags (e.g., promoting a version to latest, updating next and beta pointers) using short-lived OIDC credentials...

github.blog
3
10
5,077
Automate preparation, keep approval with a maintainer. npm’s stage-only granular access tokens let CI stage new versions, while publication requires maintainer approval with 2FA. Get started ⬇️ github.blog/changelog/2026-0…

Stage-only npm tokens for safer automation - GitHub Changelog

You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token…

github.blog
1
7
4,612
The latest updates on npm 🧵⬇️
10
17
629
110,264
more replies
npm now has broader account protection. A temporary 72-hour security hold will be placed on any account after a successful recovery-code sign-in. Applicable to all npm accounts. github.blog/changelog/2026-0…

npm extends recovery-code security holds to all accounts - GitHub Changelog

npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change...

github.blog
1
1
40
8,199
Learn more recent improvements and what’s next. Tell us what would make publishing and consuming packages safer and easier. github.com/orgs/community/di…

npm’s roadmap: safer publishing, smoother workflows, and what’s next · community · Discussion...

Hi everyone, Leo here, npm's PM. I want to share what we’ve shipped since May, where we’re focusing for the rest of 2026, and what we’re considering for 2027. I also want your feedback: what wo...

github.com
1
1
29
6,593
npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/2026-0…

Restricting npm bypass-2FA granular access tokens - GitHub Changelog

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…

github.blog
3
4
24
6,756
Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.
2
7
1,868
npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing. docs.npmjs.com/trusted-publi…

Trusted publishing for npm packages | npm Docs

Documentation for the npm registry, website, and command-line interface

docs.npmjs.com
20
122
516
67,614
Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default. gh.io/npm-publish-time-scann…

npm publish-time malware scanning and dual-use metadata - GitHub Changelog

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

github.blog
5
3
30
8,036
npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box. We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇 github.blog/changelog/2026-0…

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

github.blog
3
19
114
14,971
1/ To prevent supply chain attacks following the pattern of Mini Shai Hulud, we invalidated npm granular access tokens with write access that bypass 2FA. Update the stored token and rerun the workflow for your automations.
54
188
1,523
268,203
2/ Use npm Trusted Publishing to reduce reliance on such tokens. docs.npmjs.com/trusted-publi…

Trusted publishing for npm packages | npm Docs

Documentation for the npm registry, website, and command-line interface

docs.npmjs.com
6
5
122
24,445
track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️ github.blog/changelog/2025-0…

Easily distinguish between direct and transitive dependencies for npm packages - GitHub Changelog

npm’s massive ecosystem of open source packages is one of its greatest strengths. But as a security-conscious developer, it can be tough to keep up with vulnerability reporting and updates…

github.blog
22
10
60
48,446
starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions. github.blog/2023-04-19-intro…

Introducing npm package provenance

How to verifiably link npm packages to their source repository and build instructions.

github.blog
15
74
261
137,372
Now you can create tokens with fine-grained permissions for automating your publishing and org management workflows. And a new code explorer allows you to view content of a package directly in the npm portal. github.blog/2022-12-06-new-n…

New npm features for secure publishing and safe consumption

Now you can create tokens with fine-grained permissions for automating your publishing and organization management workflows. And a new code explorer allows you to view content of a package directly...

github.blog
3
11
44
⚡️ #7: Use npm query and jq to dig into your dependencies piped.video/watch?v=h_ZpixOg… You can use the new "npm query" command and jq to answer interesting questions about your package's dependencies #terminalrocks
8
17
45
Today we opened an RFC with a proposal of how npm can collaborate with @projectsigstore to link packages to their source and build, a significant improvement to the supply chain security of the JavaScript ecosystem. github.blog/2022-08-08-new-r…

New request for comments on improving npm security with Sigstore is now open

Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages...

github.blog
7
40
145
🚀 we just shipped npm v8.16.0 with the new `npm query` command 📦 this new feature allows developers to quickly ask & answer questions about their project's dependencies. you can learn more here: github.blog/changelog/2022-0… ⬇️ to get it now, run: $ npm install -g npm

Introducing the new npm Dependency Selector Syntax - GitHub Changelog

npm query is a new top-level command as of npm v8.16.0 which accepts a Dependency Selector (as defined in the Dependency Selector Syntax Specification) & returns a filtered JSON Array/NodeList…

github.blog
4
29
77
We've launched a number of security enhancements to npm including: * Improved login and publish experience /w CLI * Connecting GitHub + Twitter accounts * All packages have been resigned and a new command `npm audit signatures` Read more at: github.blog/2022-07-26-intro…

Introducing even more security enhancements to npm

New npm security enhancements include an improved login and publish experience with the npm CLI, connected GitHub and Twitter accounts, and a new CLI command to verify the integrity of packages in...

github.blog
3
56
190
Load more