npm

GitHub

@npmjs

The package manager for JavaScript

Problems? Visit npmjs.com/support or github.com/npm/feedback

npmjs.com Joined June 2011

142 Following 148K Followers 4.7K Posts

Latest posts 5

npm @npmjs Sep 30

Manage npm dist-tags with Trusted Publishing, without keeping a separate token for the job.

Opt in per configuration, including staging-only workflows. Existing permissions stay unchanged unless you enable it.

Learn more ⬇️
github.blog/changelog/2026…

github.blog Opt-in dist-tag permissions for npm trusted publishing - GitHub Changelog Trusted publishing configurations for npm can now be granted permission to manage dist-tags (e.g., promoting a version to latest, updating next and beta pointers) using short-lived OIDC credentials...

npm @npmjs Sep 28

Automate preparation, keep approval with a maintainer.

npm’s stage-only granular access tokens let CI stage new versions, while publication requires maintainer approval with 2FA.

Get started ⬇️
github.blog/changelog/2026…

github.blog Stage-only npm tokens for safer automation - GitHub Changelog You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token…

npm @npmjs Sep 21

The latest updates on npm 🧵⬇️

npm @npmjs Aug 13

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface.
github.blog/changelog/2026…

github.blog Restricting npm bypass-2FA granular access tokens - GitHub Changelog npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…

npm @npmjs Aug 4

npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing.
docs.npmjs.com/trusted-publis…

docs.npmjs.com Trusted publishing for npm packages | npm Docs Documentation for the npm registry, website, and command-line interface