staged publishing

npm adds a human checkpoint to secure package releases

npm is adding a deliberate pause to the publishing pipeline. With staged publishing now available in npm CLI 11.15.0+ and Node 22.14.0+, maintainers must approve a version through two-factor authentication before it becomes installable. It's a straightforward safeguard against a real threat. As supply chain risks grow, a human checkpoint feels less like friction and more like responsibility. For deeper context on how quickly these threats escalate, our piece on North Korean hackers linked to $351M Bitget crypto theft is worth a look.