npm Introduces Staged Publishing for Node.js Packages with Human Approval Step

Staged Publishing Overview

npm, the package manager for Node.js, has released staged publishing, which introduces an explicit maintainer approval step for new package versions. Instead of immediate publication, a prebuilt tarball is uploaded to a stage queue. This queue is visible on npmjs.com and through the CLI.

A human maintainer must then complete a two-factor authentication challenge to release the package. Staging itself does not require 2FA, allowing non-interactive CI pipelines to upload packages to the queue. The proof of presence is required only at the final approval step.

Technical Requirements and Workflow

This feature requires npm CLI version 11.15.0 or newer and Node.js version 22.14.0 or higher. The package must already exist on the npm registry. The workflow involves a set of subcommands: `npm stage publish` to submit, `npm stage list` to view queued versions, `npm stage view <stage-id>` to inspect, `npm stage approve <stage-id>` to promote, and `npm stage reject <stage-id>` to discard.

GitHub suggests combining staged publishing with trusted publishing over OIDC. This configuration can restrict workflows to stage-only uploads, rejecting direct `npm publish` commands. Existing bulk trusted publishing configurations can be reused to migrate packages, then CI can be updated to use the newer CLI and swap the publish command.

Security Implications

The introduction of staged publishing addresses a series of supply chain incidents, including the Shai-Hulud worm attacks and issues with classic tokens. Security researcher Adnan Khan recommended that all npm publishers enable this feature immediately, particularly for CI-published packages, to prevent unapproved code from going live.

While some debate its long-term impact, proponents argue that when combined with trusted publishing, it significantly improves security by eliminating an entire class of CI-related vulnerabilities.

Additional CLI Updates

The same release also adds `--allow-file`, `--allow-remote`, and `--allow-directory` flags, alongside the existing `--allow-git`. These flags accept `all` or `none` as values and can be configured in `.npmrc` or `package.json`. The `--allow-git` flag will default to `none` in npm v12.