GitHub Adds 2FA-Gated npm Publishing and Install Source Controls
Summary
GitHub made npm staged publishing generally available, requiring maintainer approval with 2FA before releases become installable. New allow flags also let developers control installs from files, remote URLs, and directories.
Key points
- npm staged publishing is generally available; a maintainer must approve a staged package with 2FA before it becomes installable.
- GitHub says staged publishing adds proof of presence for releases, including those from CI/CD workflows and trusted publishing with OIDC.
- Staging requires existing npm registry package access and an account with 2FA enabled; new packages cannot be staged.
- The `npm stage publish` command requires npm CLI 11.15.0 or newer.
- New `--allow-file`, `--allow-remote`, and `--allow-directory` flags control installs from local files or tarballs, remote URLs, and local directories.
- GitHub recommends pairing staged publishing with trusted publishing using OIDC; the update comes amid reported supply-chain attacks, including package poisoning attributed to TeamPCP.
Article Details
- Event Type
- GitHub introduced staged publishing and new install-source controls for npm.
- Impact
- Staged publishing requires a human maintainer to approve a package release with 2FA before it becomes installable, adding proof of presence to releases, including those published through CI/CD. New allow flags let developers control installs from local files, remote URLs, and local directories. The changes are intended to reduce software supply-chain risk; the article cites package poisoning by TeamPCP as part of a broader surge in attacks.