NPM staged publishing for supply-chain security
The article introduces staged publishing, a new NPM security feature that allows package maintainers to publish updates in phases, reducing the risk of supply-chain attacks by enabling community review before full rollout.
Background
npm (Node Package Manager) is the default package registry for JavaScript/Node.js, used by millions of developers to publish and download reusable code packages. Supply-chain security in this context refers to the risk that a package update could be malicious (e.g., inject malware, steal credentials) — a growing concern after high-profile incidents like the **event-stream** (2018) and **node-ipc** (2022) compromises.
**Staged publishing** (called "staged rollouts" in some ecosystems) is a practice where a new package version is initially made available only to a small subset of users, then gradually expanded, so problems can be caught before the release reaches everyone. This contrasts with npm's default behavior, where a `npm publish` immediately makes the new version visible to all.
The author proposes making staged publishing a first-class npm feature — not just a manual workaround — to give maintainers a safety buffer and reduce the blast radius of accidental or malicious releases.