--- title: npm Staged Publishing Available, Adding a Human Approval... description: npm has made staged publishing generally available, introducing a human approval step before a package version becomes installable. Instead of immediate... canonical: https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live | daily.dev og:description: npm has made staged publishing generally available, introducing a human approval step before a package version becomes installable. Instead of immediate... og:url: https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj og:image: https://api.daily.dev/og/posts/uT80yUiKJ.png og:image:alt: npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 0 upvotes · 0 comments ## Summary npm has made staged publishing generally available, introducing a human approval step before a package version becomes installable. Instead of immediate publishing, a tarball is uploaded to a stage queue visible on npmjs.com and the CLI. A maintainer must then pass a 2FA challenge to approve or reject it. CI pipelines are unaffected since staging works without 2FA. The feature requires npm CLI 11.15.0+ and Node 22.14.0+. New permission flags (--allow-file, --allow-remote, --allow-directory) are also included. GitHub recommends pairing staged publishing with trusted publishing over OIDC to block direct npm publish from CI. Competitors pnpm 11.3 and Yarn have already added equivalent stage subcommands. Community reaction is mixed: some see it as a meaningful defense against supply chain attacks, others view it as a band-aid that only works if maintainers adopt it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What npm CLI and Node.js versions are required to use staged publishing? Staged publishing requires npm CLI 11.15.0 or newer and Node 22.14.0 or higher, and the package must already exist on the registry. The workflow adds subcommands including npm stage publish, npm stage list, npm stage view, npm stage approve, and npm stage reject, with approval requiring a two-factor authentication challenge before the version becomes installable. _daily.dev helps teams track npm CLI and Node version requirements before rolling out security features like this._ ### How does npm staged publishing protect against supply chain attacks like Shai-Hulud? Staged publishing uploads a package tarball to a queue instead of publishing it directly, requiring a human maintainer to pass a two-factor authentication challenge before it becomes installable to consumers. This closes a class of CI takeover publish attacks, since CI can stage a release over OIDC trusted publishing but cannot push it live without human approval, denying attacks like the Shai-Hulud worm. _developers securing CI pipelines against supply chain attacks can follow npm ecosystem changes like this via daily.dev._ ### Do other JavaScript package managers besides npm support staged publishing? Yes, pnpm 11.3 added a pnpm stage command with the same subcommands as npm, Yarn exposes yarn npm stage list, and the release-it tool supports a stage: true option. pnpm additionally delays installing very new releases by default as a complementary defense against supply chain attacks. _daily.dev keeps developers comparing pnpm, Yarn, and npm publishing workflows up to date on ecosystem changes._ ## Similar posts on daily.dev - [Staged publishing and new install-time controls for npm](https://daily.dev/posts/staged-publishing-and-new-install-time-controls-for-npm-xuqa9yew1) · GitHub Changelog · 6 upvotes · 2 comments - [Multiple trusted publishing configurations for npm](https://daily.dev/posts/multiple-trusted-publishing-configurations-for-npm-paxb4vogc) · GitHub Changelog · 0 upvotes · 0 comments - [The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog](https://daily.dev/posts/the-secure-way-to-release-an-npm-package-in-2026-martian-chronicles-evil-martians-team-blog-mync64xw0) · RUBYLAND · 0 upvotes · 0 comments - [npm Introduces minimumReleaseAge and Bulk OIDC Configuration](https://daily.dev/posts/npm-introduces-minimumreleaseage-and-bulk-oidc-configuration-tw6gntfnf) · Socket · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#authentication](https://daily.dev/tags/authentication), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live","url":"https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj"},"datePublished":"2026-08-07T06:24:58.224Z","dateModified":"2026-09-14T06:28:38.307Z","description":"npm has made staged publishing generally available, introducing a human approval step before a package version becomes installable. Instead of immediate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6977583f6c7fece3627b48407c3bce85?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6977583f6c7fece3627b48407c3bce85?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs,authentication,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/npm-staged-publishing-available-adding-a-human-approval-step-before-packages-go-live-ut80yuikj#faq","mainEntity":[{"@type":"Question","name":"What npm CLI and Node.js versions are required to use staged publishing?","acceptedAnswer":{"@type":"Answer","text":"Staged publishing requires npm CLI 11.15.0 or newer and Node 22.14.0 or higher, and the package must already exist on the registry. The workflow adds subcommands including npm stage publish, npm stage list, npm stage view, npm stage approve, and npm stage reject, with approval requiring a two-factor authentication challenge before the version becomes installable. daily.dev helps teams track npm CLI and Node version requirements before rolling out security features like this."}},{"@type":"Question","name":"How does npm staged publishing protect against supply chain attacks like Shai-Hulud?","acceptedAnswer":{"@type":"Answer","text":"Staged publishing uploads a package tarball to a queue instead of publishing it directly, requiring a human maintainer to pass a two-factor authentication challenge before it becomes installable to consumers. This closes a class of CI takeover publish attacks, since CI can stage a release over OIDC trusted publishing but cannot push it live without human approval, denying attacks like the Shai-Hulud worm. developers securing CI pipelines against supply chain attacks can follow npm ecosystem changes like this via daily.dev."}},{"@type":"Question","name":"Do other JavaScript package managers besides npm support staged publishing?","acceptedAnswer":{"@type":"Answer","text":"Yes, pnpm 11.3 added a pnpm stage command with the same subcommands as npm, Yarn exposes yarn npm stage list, and the release-it tool supports a stage: true option. pnpm additionally delays installing very new releases by default as a complementary defense against supply chain attacks. daily.dev keeps developers comparing pnpm, Yarn, and npm publishing workflows up to date on ecosystem changes."}}]} ```