In response to repeated supply chain attacks, npm introduces “staged releases,” adding a mechanism that prevents packages from being published with a leaked token alone

npm has introduced staged publishing, adding maintainer review and 2FA approval before a package goes public.

This means a leaked token alone is no longer enough to publish packages, reducing the risk of abuse.

The new flow adds a human checkpoint that can stop malicious releases before they spread through the ecosystem.