npm (@npmjs) / X

npm

4,709 posts

npm

@npmjs

The package manager for JavaScript Problems? Visit npmjs.com/support or github.com/npm/feedback

Joined June 2011

npm
@npmjs
Aug 4
npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing.
Trusted publishing for npm packages | npm Docs
From docs.npmjs.com
npm
@npmjs
Jul 29
Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default.
npm publish-time malware scanning and dual-use metadata - GitHub Changelog
From github.blog
npm
@npmjs
Jul 8
npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box. We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇
npm install-time security and GAT bypass2fa deprecation - GitHub Changelog
From github.blog
npm
@npmjs
May 20
1/ To prevent supply chain attacks following the pattern of Mini Shai Hulud, we invalidated npm granular access tokens with write access that bypass 2FA. Update the stored token and rerun the workflow for your automations.
npm
@npmjs
Mar 5, 2025
track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️
Easily distinguish between direct and transitive dependencies for npm packages - GitHub Changelog
From github.blog