TLDR Tech / DevOps
Staged publishing and new install-time controls for npm
GitHub introduced staged publishing and install-time controls for npm packages, giving maintainers safer ways to roll out package releases and giving consumers more control over what gets installed. The changes are a direct response to the growing risk of compromised packages and maintainer accounts, making npm supply-chain defense more operational instead of relying only on fast takedowns after a bad release spreads.
Read the full story