Back to updates

Npm - 1

2026 (10)

September (3)

github: Stage-only npm tokens for safer automation

GitHub

2026-09-18

GitHub added a new npm granular access token permission option, Read and write (stage only). It allows automated workflows to stage package versions for review without granting the token full publish access.

github: npm extends recovery-code security holds to all accounts

GitHub

2026-09-09

npm now applies a 72-hour security hold to any account after a successful recovery-code sign-in. The hold was previously limited to high-impact accounts.

github: Multiple trusted publishing configurations for npm

GitHub

2026-09-03

GitHub says three npm publishing updates are now generally available, including support for multiple trusted publishing configurations per package. The post also mentions staged publishing and another publishing-related change, but the provided excerpt does not include the full details.

August (2)

github: License data quality improvements

GitHub

2026-08-13

GitHub now sources license information for dependency graph software components from package registries such as npmjs.org and PyPI. This is intended to improve the accuracy and completeness of displayed license data.

security: ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog

2026-08-04

Microsoft describes ChainDrop, a credential-stealing worm embedded in 400+ compromised npm packages that spread by republishing malicious updates across software ecosystems. The post outlines the attack chain, affected environments, and guidance for detection, hunting, and remediation.

July (4)

github: Restricting npm bypass-2FA granular access tokens

GitHub

2026-07-31

npm granular access tokens configured to bypass 2FA can no longer be used for sensitive account, organization, and package management actions. Those operations now require an interactive 2FA challenge.

github: npm publish-time malware scanning and dual-use metadata

GitHub

2026-07-28

npm is adding automatic malware scanning when packages are published, along with a new metadata requirement for packages that may be used for both benign and malicious purposes. The changelog says this is part of ongoing supply-chain security work and explains what publishers should expect.

security: Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Microsoft Security Blog

2026-07-16

Microsoft reports that attackers compromised AsyncAPI npm packages and used trusted CI/CD workflows to distribute malware via npm. The writeup details the attack chain, import-time payload delivery, and suggested defenses.

github: npm install-time security and GAT bypass2fa deprecation

GitHub

2026-07-08

npm v12 is now generally available and tagged latest. It enables the install-time security defaults announced in June and starts deprecating GAT bypass2fa.

June (1)

github: Dependabot no longer infers .npmrc

GitHub

2026-06-30

Dependabot no longer infers .npmrc settings for npm private registries. Instead of reconstructing .npmrc from lockfile URLs, it will stop trying to guess configuration based on potentially incorrect lockfile data.