NPM TO IMPLEMENT STAGED PUBLISHING AFTER TURBULENT SHIFT OFF...

Summary from the TLDR Dev newsletter

npm is implementing staged publishing, a new feature that will introduce a review window before packages go live. This will require MFA-verified approval from package owners to catch malicious changes before they spread. This comes after the 2025 Shai-Hulud supply chain attacks and a disruptive migration away from classic npm tokens in December that caused workflow disruptions for maintainers.