#0001
Staged publishing and new install-time controls for npm
70radar
npm enhances supply-chain security with staged publishing and new --allow-* install flags. These features provide granular control over package sources, mitigating dependency attacks.
staged publishing: Publish withnpm publish --stage <name>and later promote withnpm stage promote. This prevents accidentally tagging a pre-release as `latest`.--allow-*flags: New flags like--allow-fileand--allow-remotelet you explicitly whitelist installation sources duringnpm install, expanding on the existing--allow-git.- Both features focus on hardening defenses against supply-chain attacks. It's a good practice to configure them in
.npmrceven for solo projects with many dependencies.
Source: github.blog/changelog/2026-05-22-staged-publishing-and-nRead original →
