npm Introduces Staged Publishing With Mandatory 2FA Gate for Maintainer Approval

GitHub has made staged publishing generally available on npm, requiring maintainers to pass a two-factor authentication (2FA) challenge before any new version of a package becomes installable by the public. The change, announced this week, is intended to interrupt the class of attacks in which a stolen maintainer token or a phantom CI job pushes a malicious release to the registry without human review.

Under the new workflow, a publish action places the package into a staging state. It does not yet resolve for npm install. A maintainer must then approve the release through an interactive 2FA prompt before it is promoted to the public tarball URL. The gate applies to automated pipelines as well, meaning a compromised GitHub Actions workflow can stage a release but cannot, on its own, ship it.

"Staged publishing puts a human checkpoint in front of every release," said Xavier Rene-Corail, senior director of security research at GitHub, in the company's announcement. The post frames the control as a direct response to the Shai-Hulud worm and the s1ngularity incident earlier this year, both of which propagated through maintainer credentials harvested from CI environments.

The registry is also adding granular install-time controls. Organisations can now restrict which packages and which versions are permitted to resolve inside their scope, an option that sits alongside the existing provenance attestations npm introduced in 2023. Maintainers retain the ability to revoke a staged release before promotion.

The broader policy direction is consistent with guidance issued by the Cybersecurity and Infrastructure Security Agency (CISA) in its Secure by Design pledge, which asks software producers to make multi-factor authentication the default for privileged actions on production systems. CISA has repeatedly identified package registries as a high-value target.

The controls do not address every failure mode. A maintainer who approves a malicious commit they did not write will still ship it. Typosquatting remains out of scope. And nothing in staged publishing prevents an attacker who has captured both a maintainer's password and their 2FA device from clearing the gate themselves.

Still, the friction is the point.

GitHub said staged publishing is available now for all npm accounts at no cost, with documentation published alongside the rollout. Organisation administrators will be able to enforce the control across their scopes beginning in the first quarter of 2026, at which point the registry intends to begin deprecating long-lived classic publish tokens. Maintainers using those tokens should expect a migration notice before the cutover.