CuraDevOps

tag: Npm · 5 items

Plan archived npm trusted publishing gains opt-in dist-tag permissions via OIDC
2026-10-01 · GitHub Changelog · source ↗ #npm#trusted-publishing#supply-chain
  • Platform/SRE — Skip
  • CI/CD — Plan: New GA capability lets npm trusted publishing configs manage dist-tags (latest, next, beta promotion) with short-lived OIDC credentials instead of long-lived tokens — schedule adoption to reduce static secret exposure in publish workflows.
  • Leader — Skip
Plan archived GitHub adds stage-only scope for npm granular access tokens
2026-09-19 · GitHub Changelog · source ↗ #npm#supply-chain#token-security
  • Platform/SRE — Skip
  • CI/CD — Plan: Adopt the new ‘stage only’ permission when minting npm automation tokens to enforce least-privilege publishing; schedule a rotation of existing CI npm tokens to apply the tighter scope and reduce blast radius from a leaked credential.
  • Leader — Skip
Learn archived npm extends 72-hour security hold to all accounts after recovery-code sign-in
2026-09-11 · GitHub Changelog · source ↗ #npm#supply-chain-security#account-security
  • Platform/SRE — Skip
  • CI/CD — Learn: npm now applies a 72-hour security hold to any account following a recovery-code sign-in, broadening a protection previously limited to high-impact accounts; no pipeline changes are needed since CI automation should use tokens, not recovery codes, but this informs npm supply-chain security posture.
  • Leader — Skip
Plan archived GitHub npm trusted publishing gains multiple configs (GA)
2026-09-04 · GitHub Changelog · source ↗ #npm#trusted-publishing#supply-chain
  • Platform/SRE — Skip
  • CI/CD — Plan: Multiple trusted publishing configurations per npm package are now GA on GitHub, enabling more flexible provenance-backed release workflows; schedule a review of existing npm publish pipelines to adopt multi-config trusted publishing and reduce reliance on long-lived tokens.
  • Leader — Skip
  • Signals: GA announcement
Plan archived npm adds publish-time malware scanning and dual-use metadata requirement
2026-07-29 · GitHub Changelog · source ↗ #npm#supply-chain-security#package-security
  • Platform/SRE — Skip
  • CI/CD — Plan: Teams that publish npm packages via their release pipelines should review the new dual-use metadata requirement to ensure compliance before enforcement begins; no hard deadline surfaced in the item, so schedule this in the next pipeline audit cycle.
  • Leader — Learn: npm’s automated publish-time scanning strengthens the ecosystem’s supply-chain posture; worth noting as a positive signal when reviewing org-wide software supply-chain policy, but no leadership decision is required now.