The package manager for JavaScript Problems? Visit npmjs.com/support or github.com/npm/feedback
- Tweets 4,708
- Following 142
- Followers 147,124
- Likes 672
Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed.
We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default.
gh.io/npm-publish-time-scann…
3
3
24
5,068
npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box.
We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇
github.blog/changelog/2026-0…
2
19
111
14,049
2/ Use npm Trusted Publishing to reduce reliance on such tokens.
docs.npmjs.com/trusted-publi…
6
5
123
24,164
track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️
github.blog/changelog/2025-0…
22
10
61
48,125
starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions.
github.blog/2023-04-19-intro…
14
75
262
137,164
Now you can create tokens with fine-grained permissions for automating your publishing and org management workflows. And a new code explorer allows you to view content of a package directly in the npm portal. github.blog/2022-12-06-new-n…
3
11
44
npm retweeted
⚡️ #7: Use npm query and jq to dig into your dependencies youtube.com/watch?v=h_ZpixOg…
You can use the new "npm query" command and jq to answer interesting questions about your package's dependencies
#terminalrocks
8
17
46
Today we opened an RFC with a proposal of how npm can collaborate with @projectsigstore to link packages to their source and build, a significant improvement to the supply chain security of the JavaScript ecosystem. github.blog/2022-08-08-new-r…
7
40
144
🚀 we just shipped npm v8.16.0 with the new `npm query` command
📦 this new feature allows developers to quickly ask & answer questions about their project's dependencies. you can learn more here: github.blog/changelog/2022-0…
⬇️ to get it now, run:
$ npm install -g npm
4
29
77
We've launched a number of security enhancements to npm including:
* Improved login and publish experience /w CLI
* Connecting GitHub + Twitter accounts
* All packages have been resigned and a new command `npm audit signatures`
Read more at: github.blog/2022-07-26-intro…
3
56
193
do you publish from a npm workspace & use a root-level ignore file? if so, you should update to npm v8.11.0 or the latest versions of Node.js 16/17/18 to avoid a recently discovered vulnerability that wouldn't respect these files.
read the advisory here: github.co/3zebIPH
4
24
44
npm retweeted
GitHub has been actively investigating the attack campaign around stolen OAuth tokens, of which @npmjs was a victim organization. Today we’re sharing our final impact analysis for npm as well as additional findings. github.blog/2022-05-26-npm-s…
GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users. github.blog/2022-04-15-secur…
2
98
192
🔒 an enhanced npm 2FA experience is now available in public beta. it includes:
* support for physical security keys and biometric devices
* support for multiple second factors
* a new 2FA configuration menu
and more!
github.blog/2022-05-10-enhan…
2
34
60
🚀 Our CLI team just shipped their weekly release!
📦 npm@8.9.0 makes `npm owner` workspace-aware & also comes with some docs, deps & core updates/fixes.
⬇️ Get it now:
$ npm install -g npm
See more in the changelog:
github.com/npm/cli/releases/…
8
24
npm retweeted
A new @npmjs cli release is out! 🚀
📦 npm@8.8.0 adds a new `--install-links` option to opt into packing+install dependencies defined using the `file:` protocol instead of symlinking.
⬇️ Get it now:
$ npm install -g npm
See more in the changelog: github.com/npm/cli/releases/…
1
8
21
we've got a jam packed Open RFC call today w/ some exciting topics like: v9 roadmap, `npm query` + dependency selector syntax, command-specific configuration & more...
come join us live at 2pm EST: github.com/npm/rfcs/issues/5…
#npm #nodejs #javascript
2
8
17
npm retweeted
It's npm cli release day again! 🎉
🚀 npm@8.4.1
- fixes `npm ci` lock file validation
- fixes parsing aliases in `npm outdated`
- And more!
⬇️ Get it now:
npm install -g npm
See more in the changelog: github.com/npm/cli/releases/…
22
7
33
exciting open rfc meeting planned today at 11am pt / 2pm et; we've got a full agenda including new rfcs for package distributions & ux changes to clean up deprecation warnings: github.com/npm/rfcs/issues/5…
🎙 come join the discussion or watch live on youtube
youtube.com/channel/UCK71Wk0…
12
4
11
today we enrolled all maintainers of the top-100 npm packages in mandatory 2FA. read more about it on our blog: github.blog/2022-02-01-top-1…
7
33
198