{"id":1031,"date":"2026-05-23T17:20:57","date_gmt":"2026-05-23T17:20:57","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1031"},"modified":"2026-05-23T17:20:57","modified_gmt":"2026-05-23T17:20:57","slug":"npm-adds-2fa-gated-publishing-and-package-install-controls-against-supply-chain-attacks","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1031","title":{"rendered":"npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 23, 2026<\/span><\/span>Software Supply Chain \/ DevSecOps<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation.<\/p>\n

Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication (2FA) challenge to approve a package before it is pushed to the npmjs[.]com.<\/p>\n

\u00abInstead of a direct publish that immediately makes a package version available to consumers, the prebuilt tarball is uploaded to a stage queue where a maintainer must explicitly approve it before it becomes installable,\u00bb GitHub said<\/a>.<\/p>\n

The Microsoft-owned subsidiary said the change ensures \u00abproof of presence\u00bb for every publish, including those that come from non-interactive CI\/CD workflows and trusted publishing with OpenID Connect (OIDC) authentication.<\/p>\n

Before using staged publishing<\/a>, package maintainers have to meet the following criteria –<\/p>\n