Back to Devoured - May 27, 2026
DEVOURED
Staged publishing and new install-time controls for npm

Staged publishing and new install-time controls for npm

DevOps securityjavascriptnpm GitHub
GitHub introduced staged publishing for npm, requiring human 2FA approval before package versions become public, and added new --allow-* install flags to control non-registry dependency sources.
What: GitHub announced (May 22, 2026) general availability of staged publishing for npm and new install-time controls (--allow-file, --allow-remote, --allow-directory) in npm CLI 11.15.0 or newer. Staged publishing uploads packages to a queue for maintainer approval (requiring 2FA) before public release.
Why it matters: This represents a significant shift in npm's security posture, moving from reactive takedowns to proactive supply-chain defense, directly addressing the increasing risks of compromised packages and maintainer accounts with stronger human oversight.
Takeaway: Update your CI/CD workflows to use `npm stage publish` for critical packages and consider setting new `--allow-*` flags to `none` in your `.npmrc` for stricter dependency management.
Deep dive
  • Staged publishing ensures that a package version uploaded to npm is not immediately live; it first goes into a queue.
  • A human maintainer must explicitly approve the staged package, with a 2FA challenge, before it's released to the registry.
  • This feature reinforces "proof of presence" for every publish, including those from non-interactive CI/CD workflows and trusted publishing with OIDC.
  • GitHub recommends pairing staged publishing with trusted publishing, limiting CI workflows to stage-only publishes.
  • The new --allow-file, --allow-remote, and --allow-directory flags complement the existing --allow-git flag.
  • These flags allow developers to explicitly control which non-registry sources (file paths, remote URLs, local directory installs, and git sources) npm install can use.
  • The default for --allow-git will change from all to none in the next major CLI version (v12), making it an opt-in for Git sources.
  • These controls aim to mitigate supply-chain attacks by preventing the accidental or malicious installation of packages from untrusted local or remote sources.
Decoder
  • npm: Node Package Manager, the default package manager for the JavaScript runtime Node.js.
  • Supply-chain security: Protecting software components and dependencies throughout their lifecycle from malicious tampering or vulnerabilities.
  • OIDC: OpenID Connect, an authentication layer on top of the OAuth 2.0 framework, often used for trusted publishing to verify identity.
  • 2FA: Two-Factor Authentication, a security measure requiring two different methods of verification to confirm identity.
  • .npmrc: A configuration file for npm, used to set options for individual projects or globally.
Original article

Today we’re shipping two updates focused on supply-chain security for npm:

  • Staged publishing is generally available.
  • New --allow-* install source flags (--allow-file, --allow-remote, --allow-directory) complement the existing --allow-git flag.

Both are available in npm CLI 11.15.0 or newer.

Staged publishing is generally available

Staged publishing is now generally available on npm. Instead of a direct publish that immediately makes a package version available to consumers, the prebuilt tarball is uploaded to a stage queue where a maintainer must explicitly approve it before it becomes installable. The queue is visible both on npmjs.com and in the npm CLI.

Staged publishing reinforces proof of presence on every publish, including those that originate from non-interactive CI/CD workflows and those using trusted publishing with OIDC. A human maintainer with a 2FA challenge is required to approve a staged package before it is released to the registry.

Staged publishing is live today, and so are the docs.

Requirements

  • npm CLI 11.15.0 or newer is required to use npm stage.
  • Update CI/CD workflows to use npm stage publish instead of npm publish where you want staged behavior.

Recommended setup

We recommend pairing staged publishing with trusted publishing (OIDC). A trusted publishing configuration can be limited to stage-only, which means npm publish from that workflow will be rejected and only npm stage publish is accepted. Your CI workflows continue to run non-interactively, and a maintainer later approves the staged version from the website or the CLI.

You can also run npm stage publish locally, but the highest-value setup is CI publishing to the stage queue and a maintainer approving from a trusted device.

If you already manage trusted publishing configurations in bulk, released Feb 2026, you can use it to migrate your packages to staged publishing. Remember to update your CI workflows to the new CLI version and to use npm stage publish.

New install source flags

In npm 11.10.0 we introduced --allow-git to give you control over whether npm install can resolve dependencies from Git sources. Starting in npm 11.15.0, we are adding three more flags so you can apply the same explicit-allowlist approach to every nonregistry install source:

  • --allow-file: Controls installs from local file paths and local tarballs.
  • --allow-remote: Controls installs from remote URLs, including https tarballs.
  • --allow-directory: Controls installs from local directories.
  • --allow-git (existing): Controls installs from any Git source, including github:, gitlab:, git+ URLs, and bare owner/repo shorthands.

Each flag accepts all (the current default) or none, and can also be set in .npmrc or package.json config.

Learn more by checking out our docs:

As a reminder from the Feb 2026 announcement, --allow-git will change its default from all to none in the next major version of the CLI (v12). The new --allow-file, --allow-remote, and --allow-directory flags are additions in 11.15.0—you can opt into stricter behavior today by setting them to none.

Join the discussion

We’d like to hear how you’re rolling this out. Share feedback and questions in the GitHub Community discussion.

Explore all 49 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi