How to Install / Upgrade: npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live

npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live

npm has introduced staged publishing for Node.js packages. Published versions are queued and are not installable until a maintainer approves the release. Approval requires a two-factor authentication challenge. The feature is meant to strengthen security against supply chain threats. It ships with new configurable permission flags and is available in npm CLI 11.15.0 and later, and with Node 22.14.0 and later.

To use staged publishing, upgrade to Node 22.14.0 or newer, then upgrade the npm CLI to 11.15.0 or newer. After upgrading, use the staged publishing flow so new package versions are queued instead of going live immediately. When you are ready to release a queued version, complete the maintainer approval step and pass the two-factor authentication challenge so the version becomes installable. Configure the new permission flags as needed for your publish workflow.

Before relying on the feature, confirm your environment meets the minimums: npm CLI 11.15.0 or later and Node 22.14.0 or later. If either is below those versions, staged publishing will not be available. After a staged publish, verify that the version stays non-installable until approval and 2FA succeed, then confirm it becomes installable only after that step. Misconfigured permission flags can block or alter who can approve a release, so check those settings if approval fails or the version never goes live.