npm adds publish-time malware scanning and dual-use metadata requirement

Wed, 29 Jul 2026 12:56:53 +0000

Platform/SRE — Skip
CI/CD — Plan: Teams that publish npm packages via their release pipelines should review the new dual-use metadata requirement to ensure compliance before enforcement begins; no hard deadline surfaced in the item, so schedule this in the next pipeline audit cycle.
Leader — Learn: npm’s automated publish-time scanning strengthens the ecosystem’s supply-chain posture; worth noting as a positive signal when reviewing org-wide software supply-chain policy, but no leadership decision is required now.

Npm on CuraDevOps