NPM TO IMPLEMENT STAGED PUBLISHING AFTER TURBULENT SHIFT OFF CLASSIC TOKENS

Summary from the TLDR InfoSec newsletter

npm has announced a new release strategy called staged publishing to protect against future compromises in the wake of 2025's Shai-Hulud supply chain compromises. Staged publishing will complement npm's previous credentials safety efforts by requiring new project releases to be manually approved via an MFA-verified maintainer. Package maintainers have expressed a need for more registry-level protections after npm's chaotic removal of classic tokens.