Post

npm is making safer publishing easier to adopt. Now generally available: • Multiple trusted publishing configurations per package • Staged packages can only be approved after malware scanning is complete • Maintainers can see their staged history in the package versions tab

npm now has broader account protection. A temporary 72-hour security hold will be placed on any account after a successful recovery-code sign-in. Applicable to all npm accounts.