NPM's New Staging Feature: A Hobbyist's Guide to Safer Package Publishing

The Big News: NPM Finally Adds a Human Gate

If you've ever published a package to NPM, you know the drill: you type npm publish, and within seconds your code is live for the entire world to install. That's convenient, but it's also a little scary. One bad commit, one compromised token, and you've just handed malicious code to thousands of unsuspecting developers.

That's exactly what's been happening. Over the past year, we've seen worms like Shai-Hulud rip through the ecosystem, and NPM has been forced to deprecate traditional authentication tokens. Something had to give.

So now, NPM has rolled out a feature called staged publishing. It's a simple idea: before a new version of your package becomes publicly available, a human being—you, the maintainer—has to explicitly approve it. No more instant gratification. But for hobbyist developers who just want to share a cool little utility without worrying about the apocalypse, it's a welcome safety net.

How Staging Works (Without the Corporate Jargon)

Think of it like this: instead of throwing your package straight into the registry pool, you toss it into a staging area first. It sits there, visible to you and anyone you've granted access, until you give the thumbs up. Only then does it actually go live.

Here's the workflow, which you run from your terminal:

• npm stage publish – submit your new version to the queue
• npm stage list – see what's waiting for approval
• npm stage view <stage-id> – inspect the tarball, make sure nothing weird is inside
• npm stage approve <stage-id> – promote it to the registry (this is where you'll need 2FA)
• npm stage reject <stage-id> – throw it in the trash if something looks off

The cool part is that the staging phase itself doesn't require 2FA. That means your continuous integration pipeline can still push updates automatically—it just can't push them all the way to the public. The human check happens at the final approval step, which is exactly where you want it.

Why This Matters for Hobby Projects

You might think, "I'm just a hobbyist, my package has 37 downloads—who cares?" But that's precisely the mindset that leads to trouble. Attackers don't discriminate. They scan for any package that's even remotely popular, and if your little utility gets a few thousand downloads because it's handy, you become a target.

Remember the event-stream incident? A maintainer's account was compromised, and a malicious dependency was slipped into a package that was used by thousands of projects. The maintainer probably thought, "Who'd want to hack me?"

Staging doesn't stop a compromised account from publishing—but it does force the attacker to pass a 2FA challenge. That's a serious hurdle. And if you're using OIDC-based trusted publishing (which NPM recommends), you can configure your CI to only have permission to stage, not to approve. That way, even if an attacker hijacks your build pipeline, they can't push to the public registry without your personal approval.

The Human Factor: A Little Extra Friction Is a Good Thing

Some folks on Hacker News have grumbled that staging is just a "band-aid." They argue that it doesn't fix the root problem of supply-chain insecurity. And they're right—it's not a silver bullet. But as one commenter pointed out, it's a major improvement for trusted publishing, because it closes an entire class of attacks where someone compromises a CI environment and publishes malicious versions.

For a hobbyist, the extra step is a small price to pay for peace of mind. You're already spending your free time tinkering with code. What's another minute or two to run npm stage approve? It also gives you a moment to double-check what you're about to ship. You can inspect the tarball, run a quick diff, and make sure you didn't accidentally include your .env file or a stray debug script.

Competitors Are Catching On

NPM isn't the only one doing this, which is a good sign. The other major package managers have quickly followed suit:

• pnpm added pnpm stage in version 11.3, with the same subcommands as NPM.
• Yarn has a similar feature in the works.
• release-it now supports a "stage": true option.

Interestingly, pnpm also introduced a default delay for installing newly published versions, which gives maintainers a window to catch mistakes before too many people pull the update. It's a clever companion to staging.

Practical Tips for Hobbyist Maintainers

If you're ready to try this out, here's what you need to know:

• You'll need npm CLI version 11.15.0 or higher and Node.js 22.14.0 or newer.
• Your package must already exist in the registry—this won't work for first-time publishes.
• The new --allow-file, --allow-remote, and --allow-directory flags give you more control over what your publish command can access. In npm v12, the default for --allow-git will change to none, so it's worth getting familiar with these options now.

My advice? Enable staging on your hobby projects today. It's like wearing a helmet when you ride a bike—you might feel silly at first, but it's a habit that could save you a world of hurt later.

The Future: More Guardrails Ahead

NPM has a roadmap that includes making fine-grained access tokens (the ones that can bypass 2FA) default to staging-only. And in v12, they're adding an allowScripts field that will make installation scripts opt-in by default. That's big—install scripts have been a vector for many attacks, including Shai-Hulud.

For hobbyists, this means the ecosystem is slowly becoming safer without requiring you to become a security expert. You can keep doing what you love—building fun little tools—and trust that the platform is adding layers of protection.

Wrapping Up

Staged publishing is a practical, human-centered improvement to a system that's been under siege. It doesn't solve every problem, and it does add a bit of friction. But for those of us who publish packages as a hobby, it's a small, meaningful step towards a more trustworthy npm.

So next time you're about to release that nifty new utility you've been tinkering with, give staging a shot. It might just become your favorite new habit.