Brushstrokes of Caution: How npm's Staged Rollouts Echo the Painter's Studio

The Palette Knife of Software Releases

There's a moment in every painter's studio when the canvas is nearly done. The oils are wet, the composition feels right, but something holds you back. You step away. You look again. That pause—that deliberate hesitation—can save a painting from a careless stroke. It's the same instinct that just landed in the world of software distribution.

npm, the default package manager for Node.js, has officially rolled out a staged publishing feature. Think of it as a quarantine room for your code before it hits the public gallery. Instead of your freshly uploaded package instantly appearing for anyone to install, it now waits in a staging queue. A human maintainer must step in, verify their identity with two-factor authentication, and only then give the final nod. The tarball sits there, visible on npmjs.com and in the CLI, like a canvas propped against the wall awaiting a final critique.

A Deliberate Pause, Not a Speed Bump

This isn't about slowing things down for the sake of it. The staging phase itself doesn't require 2FA—it accepts all token types, so your non-interactive CI pipelines keep humming along. The identity check is deferred to the approval moment. That's a smart move. It's like letting an assistant stretch the canvas and mix the pigments without needing the master's signature, but reserving the final brushstroke for the artist's hand.

The workflow comes with its own set of commands, a tidy little vocabulary for this new ritual:

• npm stage publish – submit the version to the stage queue
• npm stage list – see what's waiting for approval
• npm stage view <stage-id> – inspect the staged tarball
• npm stage approve <stage-id> – promote it to the registry, with a 2FA prompt
• npm stage reject <stage-id> – discard it

You need npm CLI 11.15.0 or later, Node 22.14.0 or above, and the package must already exist in the registry. It's a tool for refining what's already there, not for brand-new creations.

Why the Caution? A Canvas Stained by Supply Chain Attacks

This feature didn't emerge from a vacuum. The software world has been rattled by a series of nasty supply chain attacks. There was the Shai-Hulud worm, a name that evokes sandworms and desert planets, but the damage was all too real. Then came the official deprecation of traditional tokens. Security researcher Adnan Khan put it bluntly on X: every developer publishing to npm should enable this feature immediately. Use OIDC in your CI, get the package reviewed before it goes public. Shai-Hulud? Rejected.

It's the same logic that makes a painter seal a painting with varnish and let it cure in a dust-free room. You don't hang a wet canvas in a gallery and hope no one sneezes on it. You protect the work until it's ready.

The Pushback: Is This a Band-Aid or a Barrier?

Not everyone is cheering. A Hacker News user named weinzierl offered a lukewarm take: "At best, staged publishing is a Band-Aid. But in the long run, it might hurt our efforts to build more secure infrastructure." That sounds like a critic standing in a gallery, arms crossed, muttering that the new painting is just covering up a crack in the wall.

But another reply came back fast: "How could it possibly be harmful? For trusted publishing, this isn't a Band-Aid—it's a major improvement. It closes a whole class of attacks that hijack CI environments to publish packages." The attacker might find other ways, sure, but this plugs a huge hole. Like adding a sturdy frame to a canvas—it doesn't make the painting great, but it keeps the edges from curling.

Others question adoption. User turkeyboi points out that the feature only helps if maintainers actually use it. Klaster_1 wonders if it should be mandatory by default. On Reddit, one commenter argues that this only slows the spread of malicious packages; it doesn't cure the root disease of supply chain insecurity. Fair enough. A varnish won't fix a badly drawn figure, but it will keep the paint from flaking off.

The Competition Joins the Studio

npm isn't painting in isolation. The rival package managers have picked up their brushes quickly. pnpm 11.3 added a pnpm stage command with the same subcommands. Yarn has its own equivalent. release-it supports a "stage": true option. And pnpm goes a step further: it now delays the installation of freshly published versions by default, adding another layer of caution. It's like a gallery that waits a day before hanging a new piece, just to see if the paint drips.

Looking Ahead: Scripts Under Lock and Key

GitHub has also laid out its future plans. Fine-grained access tokens that can bypass 2FA will default to staging-only. And in npm v12, there's a new allowScripts field that will make installation scripts opt-in by default. That's a big shift. Install scripts have long been a vector for malicious code, like a painter's turpentine that could be swapped for something corrosive. By default, they just won't run unless you explicitly allow them.

This is all part of a broader movement toward trust and verification. In the painting world, provenance matters—who painted this, where did it come from, is it authentic? The same questions now apply to software packages. Staged publishing is a provenance check for code.

The Artist's Approval: A Human Touch in an Automated World

The most striking thing about this feature is the reintroduction of human judgment. For years, we've automated everything—continuous integration, continuous deployment, bots that review code. But here, npm is saying: a person needs to look at this before it goes public. That's a radical idea in a world that worships speed.

It reminds me of the way a painter works with a printer to produce limited editions. The artist inspects each print, signs the ones that meet their standard, and rejects the ones with flaws. That's the essence of staged publishing. It's not about blocking progress; it's about ensuring quality and safety.

Will it be enough? Probably not, on its own. No single feature can guarantee security. But it's a meaningful step, a deliberate pause in the rush to release. It's the difference between flinging paint at a canvas and placing each stroke with intention.

As you consider your own publishing workflow, think about the painter's studio. The messy sketches, the half-finished studies, the final piece that only leaves the easel when the artist is certain. Staged publishing gives software that same chance—to be inspected, to be approved, to be worthy of the public's trust.