npm's New Staged Releases: A Political Fix for Open Source Security

When npm rolled out its staged publishing feature in August 2026, it wasn't just a technical tweak. It was a political statement. For years, the open source world has been wrestling with a fundamental question: who gets to decide what code runs on millions of machines? With this update, npm is saying that maintainers—not just automated pipelines—should have the final say.

The Backstory: A Series of Brutal Attacks

The move didn't come out of nowhere. The npm registry has been hit by a string of high-profile supply-chain attacks. The Shai-Hulud worm, for instance, spread through malicious packages, exploiting the trust developers place in the ecosystem. It was a wake-up call. Then there was the deprecation of traditional tokens, which left many teams scrambling to secure their publishing workflows.

These incidents exposed a glaring weakness: anyone with a valid token could publish a package, and it would be instantly available to the entire world. No human review. No safety net. Just code flying from a developer's laptop to millions of production servers in seconds.

What Staged Publishing Actually Does

Staged publishing inserts a human checkpoint into that flow. Instead of publishing directly, developers submit their tarball to a staging queue. That queue is visible on npmjs.com and in the CLI. Then a human maintainer has to approve it—and they need two-factor authentication to do so. Only after that approval does the package go live.

The workflow comes with a set of subcommands that feel refreshingly straightforward:

• npm stage publish – push your version to the staging queue
• npm stage list – see what's waiting for approval
• npm stage view <stage-id> – inspect the tarball before you approve it
• npm stage approve <stage-id> – promote it to the registry (this prompts for 2FA)
• npm stage reject <stage-id> – throw it in the trash

Notably, the staging step itself doesn't require 2FA, so CI pipelines that use non-interactive tokens can still push to the queue. The identity check is deferred to the approval step, which keeps automation humming while adding a human gate.

The Requirements: A Bit of a Headache

There's a catch. You need npm CLI 11.15.0 or higher, and Node.js 22.14.0 or above. Your package also has to already exist in the registry—you can't stage a brand-new package. That's a limitation that might frustrate some teams, but it's a deliberate choice to keep the feature focused on updates to existing packages.

GitHub, which owns npm, suggests pairing staged publishing with OIDC-based trusted publishing. That way, you can configure your CI to only allow staging, not direct publishing. If a workflow tries to run a raw npm publish, it gets rejected. Teams that already use trusted publishing can migrate their packages to this setup without tearing down their existing configuration.

More Flags, More Control

This release also tweaks the --allow-* flags. Previously, there was just --allow-git. Now you've got --allow-file, --allow-remote, and --allow-directory as well. Each can be set to all or none, and you can configure them in .npmrc or package.json. In npm v12, --allow-git will default to none, which is a significant tightening of the reins.

The Community Reacts: Optimism and Skepticism

Security researcher Adnan Khan didn't mince words on X. He urged every npm developer to enable this feature immediately, especially if they publish via CI with OIDC. His message: get that human review in place before your code goes public. Shai-Hulud? Just say no.

But not everyone is convinced. Hacker News user weinzierl called staged publishing a band-aid. They argued that while it patches a hole, it might actually undermine long-term efforts to build more secure infrastructure. That's a fair point—if we lean too hard on human approval, we might neglect the deeper structural fixes.

Another user shot back, saying it's not a band-aid at all. For trusted publishing, it's a major improvement because it blocks a whole class of attacks where CI environments get hijacked and used to publish malicious updates. Sure, attackers might find other ways, but this closes a massive gap.

Then there's the adoption question. User turkeyboi pointed out that the feature only helps if maintainers actually use it. And Klaster_1 wondered whether npm should just force it on by default. That's a classic governance debate: should security be optional, or should the platform mandate it?

On Reddit, a commenter dismissed the whole approach as a way to slow down malicious packages, not solve the root problem. They argued that supply-chain security needs more than human checkpoints—it needs better code scanning, sandboxing, and maybe even a different trust model altogether.

Competitors Are Already Catching Up

npm might have been first, but it's not staying ahead for long. pnpm 11.3 added a pnpm stage command with identical subcommands. Yarn has its own equivalent. And release-it, a popular release tool, supports a "stage": true option. Interestingly, pnpm also defaults to delaying installation of newly published versions, which gives the ecosystem an extra buffer against fresh malicious packages.

What's Next? The Roadmap

GitHub has laid out its plans. They want to make fine-grained access tokens default to staging-only, which would effectively bypass 2FA for direct publishing. And in v12, they're adding an allowScripts field that will make installation scripts disabled by default. That's a huge shift—installation scripts have been a common vector for attacks, and turning them off by default could be a game-changer for security, even if it breaks some existing packages.

The Political Angle: Power and Trust in Code

Underneath all the technical jargon, this is a story about power. Who gets to decide what's safe to run? npm is essentially saying that automated systems aren't enough. You need humans in the loop. You need accountability. That's a political stance, even if it's dressed up in CLI commands.

It also raises questions about centralization. npm is the default package manager for Node.js, and it's owned by GitHub, which is owned by Microsoft. When a single company controls the pipeline for millions of developers, their decisions have outsized political consequences. Staged publishing might be a step forward, but it also concentrates more control in the hands of a few.

A Step Forward, or a Stumble?

So, is staged publishing a good thing? It depends on how you look at it. If you're tired of waking up to news of another compromised package, it's a welcome relief. If you're worried about the slow erosion of open source's decentralized ethos, it might give you pause.

Either way, npm has made a move. It's not a silver bullet, but it's a tangible change that could make the ecosystem safer—if enough people use it. And that's the real challenge. Security features only work when they're adopted. The debate on Hacker News and Reddit shows that the community is split. Some want mandatory enforcement; others prefer voluntary measures. It's a classic political standoff, and it's playing out in the open source arena.

In the end, staged publishing is a reminder that software security isn't just a technical problem. It's a human one. And until we figure out how to build systems that balance trust, convenience, and safety, we'll keep having these debates. For now, npm has thrown its hat in the ring. Whether it's a band-aid or a revolution, only time will tell.