npm
6 stories filed under npm on Beyond Market Intelligence. The newest of them: “From npm's creators, a secure drop-in replacement that transforms how you manage dependencies.”, “npm 12 Gives You Control Over Installation Scripts by Default”, and “GitHub's Default Security Shift Puts Waiting Periods Ahead of Signing”. The original npm team has shipped vlt 1.0, a drop-in replacement that doesn't just swap in quietly. npm 12 puts security first by flipping a long-standing default: install scripts now run only with explicit approval. Acme AI is the next-generation, AI-powered spreadsheet platform built to replace Excel and redefine how analysts, data scientists, and enterprise teams work… The list below is every npm story on Beyond Market Intelligence, newest first.
From npm's creators, a secure drop-in replacement that transforms how you manage dependencies.
The original npm team has shipped vlt 1.0, a drop-in replacement that doesn't just swap in quietly. It brings phased installs to stop automatic script execution, a queryable dependency graph with over 60 selectors, and hosted registries that block malicious packages. That's a direct answer to the kind of supply-chain risk we've seen escalate elsewhere. For developers feeling the weight of complex tooling, this is a practical step toward a safer, more transparent workflow. It's worth exploring.
npm 12 Gives You Control Over Installation Scripts by Default
npm 12 puts security first by flipping a long-standing default: install scripts now run only with explicit approval. That's a meaningful shift, especially for teams wary of automatic code execution during builds. The registry also tightens its stance on non-registry sources, responding directly to real community concerns. It's a measured, confident update that prioritizes control over convenience. For those tracking broader data risks, our piece on AI agents sharing user images offers a timely parallel. Explore both, and decide where your trust belongs.
GitHub's Default Security Shift Puts Waiting Periods Ahead of Signing
GitHub's latest npm and Actions updates, shipped from March through July 2026, harden defaults against supply chain attacks rather than just adding new options. That's a sensible shift, though Hacker News commenters are split on whether waiting periods truly solve the problem or merely delay it. Author-side package signing still feels like the missing piece. These controls are welcome, but they shouldn't replace a more direct path to trust.
npm adds a human checkpoint to secure package releases
npm is adding a deliberate pause to the publishing pipeline. With staged publishing now available in npm CLI 11.15.0+ and Node 22.14.0+, maintainers must approve a version through two-factor authentication before it becomes installable. It's a straightforward safeguard against a real threat. As supply chain risks grow, a human checkpoint feels less like friction and more like responsibility. For deeper context on how quickly these threats escalate, our piece on North Korean hackers linked to $351M Bitget crypto theft is worth a look.
The npm supply chain attack that earned its trust before striking.
The keyv worm didn't fake its security check. It earned one. That's the part that should unsettle every security team. The poisoned releases shipped with valid provenance signatures because they ran through the maintainer's own pipeline. Valid credentials, not a broken control, did the damage. The trust signals built to secure the supply chain were satisfied by an attacker holding the right account. That's not a bug in the machinery. It's the shape of the exposure.
Rspack 2.0 delivers faster builds with a leaner, modern ESM core.
Rspack 2.0 strips away the weight of legacy dependencies to focus on what modern JavaScript needs: a pure ESM core. ByteDance's team delivered measurable build-time gains, with npm downloads now clearing 5 million weekly, a sign developers feel the difference. The improved static analysis and RSC support point to a tool built for today's workflows, not yesterday's assumptions. For a deeper look at how performance-focused tooling evolves, our piece on compiling TypeScript to native code offers a useful contrast.