npm

The package manager for JavaScript

Problems? Visit or

[npm @npmjs]

Manage npm dist-tags with Trusted Publishing, without keeping a separate token for the job.

Opt in per configuration, including staging-only workflows. Existing permissions stay unchanged unless you enable it.

Learn more ⬇️
https://t.co/YQwlpa6jpw

[npm @npmjs]

Automate preparation, keep approval with a maintainer.

npm’s stage-only granular access tokens let CI stage new versions, while publication requires maintainer approval with 2FA.

Get started ⬇️
https://t.co/6L8P8NuWPb

[npm @npmjs]

Learn more recent improvements and what’s next. Tell us what would make publishing and consuming packages safer and easier.
https://t.co/0UWckbsXow

[npm @npmjs]

The latest updates on npm 🧵⬇️

[npm @npmjs]

npm now has broader account protection.

A temporary 72-hour security hold will be placed on any account after a successful recovery-code sign-in.

Applicable to all npm accounts.
https://t.co/0qSsUk3tPs

[npm @npmjs]

Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.

[npm @npmjs]

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface.
https://t.co/c4P47SKYfr

[npm @npmjs]

npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing.
https://t.co/uSR5o31X5i

[npm @npmjs]

Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed.

We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default.
https://t.co/GAN3Qm05NA

[npm @npmjs]

npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box.

We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇
https://t.co/HI4tSNOO3l

[npm @npmjs]

2/ Use npm Trusted Publishing to reduce reliance on such tokens.
https://t.co/iZf76MeJAU

[npm @npmjs]

1/ To prevent supply chain attacks following the pattern of Mini Shai Hulud, we invalidated npm granular access tokens with write access that bypass 2FA. Update the stored token and rerun the workflow for your automations.

[npm @npmjs]

track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️
https://t.co/qpGGToVKFb

[npm @npmjs]

starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions.
https://t.co/8zilYJz5Dc

[npm @npmjs]

Now you can create tokens with fine-grained permissions for automating your publishing and org management workflows. And a new code explorer allows you to view content of a package directly in the npm portal. https://t.co/AO2RIV7TD1

[Elijah Manor @elijahmanor]

⚡️ #7: Use npm query and jq to dig into your dependencies https://t.co/PWfxmK21ja

You can use the new "npm query" command and jq to answer interesting questions about your package's dependencies

#terminalrocks

[npm @npmjs]

Today we opened an RFC with a proposal of how npm can collaborate with @projectsigstore to link packages to their source and build, a significant improvement to the supply chain security of the JavaScript ecosystem. https://t.co/GbHkir0pFA

[npm @npmjs]

🚀 we just shipped npm v8.16.0 with the new `npm query` command

📦 this new feature allows developers to quickly ask & answer questions about their project's dependencies. you can learn more here: https://t.co/ZnAqV4x2Am

⬇️ to get it now, run:
$ npm install -g npm

[npm @npmjs]

We've launched a number of security enhancements to npm including:
* Improved login and publish experience /w CLI
* Connecting GitHub + Twitter accounts
* All packages have been resigned and a new command `npm audit signatures`

Read more at: https://t.co/yUd0yT9DOk