npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

npm has introduced new security controls including staged publishing with 2FA approval and install source flags to prevent supply chain attacks.

• •Staged Publishing requires maintainers to pass 2FA verification before making packages publicly available on npm
• •Supports CI/CD workflows and OIDC trusted publishing for non-interactive environments
• •Three new install flags (--allow-file, --allow-remote, --allow-directory) provide explicit allowlist control over non-registry sources
• •Requires npm CLI 11.15.0 or newer to use staged publishing functionality
• •Addresses the surge in supply chain attacks targeting open-source ecosystems

This summary was automatically generated by AI based on the original article and may not be fully accurate.