npm Introduces Human Approval Gates for Package Releases

npm is rolling out two major security enhancements that address critical gaps in supply chain management. Staged publishing introduces mandatory human verification before packages reach consumers—a critical safeguard when integrated with CI/CD pipelines and OIDC-based trusted publishing. Combined with new install-time flags that let developers explicitly control which external sources can resolve dependencies, these changes significantly reduce the attack surface for dependency-related vulnerabilities.