npm, the default package manager for Node.js and now maintained by GitHub, has made staged publishing generally available, adding an explicit maintainer approval step before a published version becomes installable.
Instead of a direct publish that immediately exposes a version to consumers, the prebuilt tarball is uploaded to a stage queue that is visible both on npmjs.com and in the CLI. A human maintainer must then pass a two-factor authentication challenge to release it. Staging itself does not require 2FA and works with any token type, so non-interactive CI pipelines are unaffected, and the proof of presence moves to the approval step. The feature requires npm CLI 11.15.0 or newer and Node 22.14.0 or higher, and the package must already exist on the registry.
The workflow is a small set of subcommands:
npm stage publish # submit the version to the stage queue
npm stage list # list staged versions awaiting approval
npm stage view <stage-id> # inspect the staged tarball
npm stage approve <stage-id> # promote it to the registry, prompts for 2FA
npm stage reject <stage-id> # discard it
GitHub recommends pairing staging with trusted publishing over OIDC, where a configuration can be limited to stage only, so a direct npm publish from that workflow is rejected outright. Teams already using bulk trusted publishing configuration can reuse it to migrate packages, then update CI to the newer CLI and swap the publish command. The CLI reference covers flags such as --tag and --provenance, which behave as they do for npm publish.
The same release adds --allow-file, --allow-remote and --allow-directory alongside the existing --allow-git, each accepting all or none and configurable in .npmrc or package.json. --allow-git will default to none in v12.
The context is a punishing run of supply chain incidents, from the Shai-Hulud worm waves to a rocky migration off classic tokens. Security researcher Adnan Khan was unequivocal in a post on X, writing:
Everyone publishing to NPM should turn this feature on today.
Publish from CI via OIDC then approve the package before it goes live for everyone.
Shai-Hulud? Denied.
On Hacker News, weinzierl argued that:
Seen favorably, staged publishing is a band aid. Seen more realistically I believe that in the long run it will even hurt our efforts for more secure infra.
Which prompted a response:
How could it possibly hurt?
For trusted publishing, it's not a band-aid, it's a significant improvement that kills an entire class of CI takeover publish attacks. I'm sure attackers will find another way but it's a big gap this is closing up.
Others questioned adoption, with turkeyboi noting it only helps "if maintainers actually use it" and Klaster_1 asking whether it should be enforced by default. A commenter on Reddit framed it as "a reduction in spread rate" rather than a cure.
Competitors have moved quickly. pnpm 11.3 added pnpm stage with the same subcommands, Yarn exposes yarn npm stage list, and release-it supports a "stage": true option. pnpm also delays installing very new releases by default, a complementary defence.
GitHub says next steps include defaulting 2FA-bypassing granular access tokens to stage only, and an allowScripts field that flips install scripts to opt-in in v12.