npm
npm on Beyond Market Intelligence: a running collection of 5 stories we have gathered and hand-picked because they are worth your time. Every post here touches on npm in some way — the news, the analysis, the deep dives, and the occasional surprise find. Acme AI is the next-generation, AI-powered spreadsheet platform built to replace Excel and redefine how analysts, data scientists, and enterprise teams work with data. New stories are added to this page as we find them, so check back if you want to keep up with what is happening around npm, or subscribe to the RSS feed to get them as soon as they are published. Browse the collection below, or head back to the homepage to see everything Beyond Market Intelligence is covering right now.
npm 12 Released: Install Scripts Off by Default as Registry Moves to Explicit Trust
npm 12 delivers a critical security update, shifting install script execution to an opt-in model. This change, addressing community concerns about automatic script risks, now requires explicit approval to run scripts—including implicit builds—enhancing user control and overall project safety. Furthermore, npm 12 restricts installation from non-registry sources. This move follows recent security vulnerabilities, as highlighted in articles like "After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug," reinforcing a future-focused approach to data management.
GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing
GitHub has significantly strengthened its defenses against supply chain attacks by consolidating npm and Actions security enhancements implemented between March and July 2026. These changes prioritize default protections, streamlining security for developers. While the controls themselves have garnered discussion, Hacker News debate centers on the efficacy of implemented waiting periods versus encouraging author-side package signing. For deeper insights into proactive security measures, explore Cloudflare’s Precursor, a behavioral analysis engine designed to detect anomalous activity.
npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live
npm has introduced staged publishing, a significant advancement in Node.js package security. Now, versions are queued and require maintainer approval—including a two-factor authentication challenge—before becoming installable. This critical step directly addresses rising supply chain risks and provides an essential layer of protection. Available in npm CLI 11.15.0+ and Node 22.14.0+, staged publishing is accompanied by new, configurable permission flags. As demonstrated by recent events, like the keyv incident discussed in "The Shai-Hulud npm worm," proactive security measures are paramount.
The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
The recent Shai-Hulud worm attack, compromising keyv and related npm packages, underscores a critical shift in software supply chain security. Attackers bypassed provenance checks—cryptographic attestations designed to verify package authenticity—by legitimately earning them through account takeover. This incident, predicted by CrowdStrike’s 2026 Threat Hunting Report, highlights the vulnerability of developer ecosystems and the speed at which exploitation occurs.
RSPack 2.0: Performance Gains, Leaner Dependencies and ESM Core
Rspack 2.0, developed by ByteDance, marks a significant advancement in web tooling. This update delivers substantial performance gains alongside a leaner dependency footprint, centered around a pure ECMAScript modules (ESM) core. Improved static analysis and support for React Server Components (RSC) further enhance its capabilities. Early benchmarks demonstrate considerable reductions in build times, reflecting the project's impressive growth—now exceeding 5 million weekly npm downloads. For those interested in agentic automation, consider exploring our recent article on "GitLab 19.2."