The NPM Registry introduced staged publishing prevents CI/CD pipelines from publishing packages by themselves, and instead adds a human-in-the-loop-with-MFA step to approve packages staged by the pipeline.
This can prevent malicious packages from being published by a compromised pipeline.
The NPM Registry introduced staged publishing prevents CI/CD pipelines from publishing packages by themselves, and instead adds a human-in-the-loop-with-MFA step to approve packages staged by the pipeline.
This can prevent malicious packages from being published by a compromised pipeline.