npm Adds Publish-Time Malware Scanning and Dual-Use Metadata
npm now automatically scans packages for malware at publish time, introducing a brief delay before packages are available. This enhances supply-chain security for all users but may require automation updates to tolerate the delay. A new metadata requirement, `contentPolicy` in `package.json` and a `DISCLOSURE` file, is introduced for dual-use content to aid automated scanning and manual review. Publishers of dual-use packages must also enforce two-factor authentication during publishing.
- →Automatic publish-time malware scanning for npm packages
- →2FA enforcement and persistent declaration for dual-use packages
- →New metadata requirement for dual-use content
- →Handling of blocked packages and appeals
Breaking changes (1) ›
- 2FA enforcement and persistent declaration for dual-use packages
Publishing dual-use packages now requires two-factor authentication enforcement, such as through trusted publishing or interactive sessions. Once declared, the dual-use metadata must persist across subsequent publishes, with non-compliance leading to rejection.
Features (1) ›
- Automatic publish-time malware scanning for npm packages
npm now automatically scans newly published packages for malware before they become available. This process may introduce a delay of typically five minutes, potentially longer during peak times or for large packages. Most publishers will not need to take action beyond accounting for this brief delay.
Enhancements (1) ›
- New metadata requirement for dual-use content
A `contentPolicy` field in `package.json` and a `DISCLOSURE` file are now required for packages with security-relevant capabilities that might resemble malware. This helps automated scanning and manual review of legitimate dual-use content.
Notes (1) ›
- Handling of blocked packages and appeals
If a package is blocked by the automated scan, publishers may receive a notification and have the option to appeal. Further actions may be taken on maintainer accounts based on the severity of findings, in line with existing policies.
https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata
Related releases
- CodeQL 2.26.1 enhances analysis accuracy and framework coverage GitHub Changelog ·
- GitHub Copilot App Usage Metrics Expanded in API GitHub Changelog ·
- Grok 4.5 reasoning model available in GitHub Copilot GitHub Changelog ·
- GitHub Actions holds workflows for approval to prevent attacks GitHub Changelog ·
- Dependabot alerts expand to cover malicious packages from OpenSSF GitHub Changelog ·
- GitHub Actions holds potentially malicious workflows for approval GitHub Changelog ·