npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing. docs.npmjs.com/trusted-publi…

Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default. gh.io/npm-publish-time-scann…

npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box. We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇 github.blog/changelog/2026-0…

track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️ github.blog/changelog/2025-0…

starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions. github.blog/2023-04-19-intro…

Now you can create tokens with fine-grained permissions for automating your publishing and org management workflows. And a new code explorer allows you to view content of a package directly in the npm portal. github.blog/2022-12-06-new-n…

⚡️ #7: Use npm query and jq to dig into your dependencies piped.video/watch?v=h_ZpixOg… You can use the new "npm query" command and jq to answer interesting questions about your package's dependencies #terminalrocks

Today we opened an RFC with a proposal of how npm can collaborate with @projectsigstore to link packages to their source and build, a significant improvement to the supply chain security of the JavaScript ecosystem. github.blog/2022-08-08-new-r…

🚀 we just shipped npm v8.16.0 with the new `npm query` command 📦 this new feature allows developers to quickly ask & answer questions about their project's dependencies. you can learn more here: github.blog/changelog/2022-0… ⬇️ to get it now, run: $ npm install -g npm

We've launched a number of security enhancements to npm including: * Improved login and publish experience /w CLI * Connecting GitHub + Twitter accounts * All packages have been resigned and a new command `npm audit signatures` Read more at: github.blog/2022-07-26-intro…

do you publish from a npm workspace & use a root-level ignore file? if so, you should update to npm v8.11.0 or the latest versions of Node.js 16/17/18 to avoid a recently discovered vulnerability that wouldn't respect these files. read the advisory here: github.co/3zebIPH

GitHub has been actively investigating the attack campaign around stolen OAuth tokens, of which @npmjs was a victim organization. Today we’re sharing our final impact analysis for npm as well as additional findings. github.blog/2022-05-26-npm-s…