The npm registry spent 2026 rebuilding the trust that all of JavaScript depends on. A series of supply-chain compromises has poisoned hundreds of packages at a time, and the response has been a push toward trusted publishing, staged releases and shorter-lived tokens (Unit 42, 2026). The good news is the registry is also adding publish-time checks.
The scale is hard to overstate. npm is the largest package registry on earth, quietly backing nearly every JavaScript install, and attackers keep going for the soft underbelly, the maintainer account. As one fix put it, a single compromised maintainer can trigger a global cascade. That is no longer hypothetical (Unit 42, 2026).
Why does npm keep breaking in 2026?
The root cause is structural, not a bug. A maintainer's credentials or CI token are enough to publish any version of every package they maintain, with no second approval and often no second factor. It is a centralized trust-on-first-use system with the keys spread across humans, and those humans keep getting phished (Systems Hardening, 2026).
For a few years it took too long to detect, and that let the compromise spread. Attackers then scaled the same trust, scanning for more secrets and re-using credentials to republish more packages. A single stolen token stops being one incident and starts being a generalized vector into hundreds of downstream projects.
What was the impact after TanStack and Axios?
Two bigger waves stand out. The TanStack wave on May 11, 2026 pushed 84 malicious versions across 42 packages by poisoning a GitHub Actions cache and extracting an OIDC token from runner memory (TanStack, 2026). Weeks earlier, an Axios incident injected a payload that reached tens of thousands of installs in about three hours.
Both hit developers and their pipelines, and the response has been a radical re-trust model. Instead of assuming any token is a maintainer, 2026 asks: can this specific token justify publishing right now? That shift is the structural reason the registry is hardening.
What did npm actually change to fix trust?
The list is long and concrete. npm launched trusted publishing via OIDC in 2023 and extended it to CircleCI in April 2026, removing the long-lived token. It added staged publishing in May 2026, keeping a version behind 2FA approval until it is explicitly promoted (npm, 2026).
- Trusted publishing everywhere — no persistent credential on disk
- Staged publishing (May 2026) — 2FA gate before a version goes live
- Install-script controls in npm v update — no auto-run of script by default
- 72-hour read-only window if a high-impact account changes email
- Automatic malware scanning at publish-time (July 2026)
- A release-downtime delay route for unverified newest versions
What is the 2026 response to an actual outbreak?
Publish-time scanning is the biggest recent step. On July 28, 2026, npm made newly published packages scanned automatically before they become installable (GitHub, 2026). The scan adds a short delay, but a package can be blocked outright before any user runs it.
The shift is preventive too. GitHub and npm now flag high-impact accounts into a 72-hour read-only state when the raw email or a 2FA signup changes, closing the takeover loophole (GitHub, 2026). The momentum is moving from reacting to a feed to blocking the mechanism of takeover before it is exploited.
Are you vulnerable if you run npm install today?
It depends almost entirely on whether your pipeline resolves the newest tag or a pinned version. A lockfile pinned to the exact tar and hash is immune to a malicious version that only moves the latest tag. The surface opens only when a build resolves latest or re-runs npm install with no lock (Systems Hardening, 2026).
| Control | What it buys you |
|---|---|
| package-lock.json + npm ci | Pins exact versions, blocks phantom latest moves |
| ignore-scripts | Blocks install and postinstall code at the source |
| Trusted publishing (OIDC) | Removes the long-lived token vector entirely |
| Staged publishing | Adds a human 2FA gate before a version ships |
| Publish-time scanning | Registry-level malware block before install |
What can a developer do to stay safe right now?
Five things. Pin with a committed lockfile and run npm ci, not install. Set ignore-scripts to true so a postinstall hook cannot run. Set a release-age that rejects tomorrow-young packages. Prefer provenance, check the signature when a big library publishes. And route installs through a private registry or proxy where you can (GitHub, 2026).
The hard truth is that once the payload runs inside npm install, treat the host as compromised. Rotate every credential it could see and watch for unexpected network calls. Danger fades to background as developers stop relying on the newest default and instead pin, scan and split their trust across layers.
Every codebase is a supply chain, and a locked, attested install is the cheapest form of insurance a team can sign.
— Theo Okafor
Is the npm trust model safe to trust in August 2026?
It is getting safer, quickly. A year of visible incidents forced structural improvement: publish-time checks, staged publishing, OIDC-only publishing and script-blocking defaults. The people who default to the lowest-risk behavior, pinning and building from CI, largely dodged the 2026 chaos.
The bottom line is written on the ecosystem. The registry can no longer be treated as a trusted drop box that is safe to install without a thought. But with a committed lockfile, script-less installs and a public and trusted source for versions, a developer can use npm every day. Trust is rebuilt one pin at a time.
Sources and further reading
- Our plan for a more secure npm supply chain — GitHub Blog
- Unit 42 — The npm Threat Landscape and Mitigations
- TanStack npm supply-chain compromise postmortem
- Why open source AI is the local-first choice
- The great site-reliability exodus
- AI slop is eating the web
Bottom line
The bottom line is written on the ecosystem. The registry can no longer be treated as a trusted drop box that is safe to install without a thought. But with a committed lockfile, script-less installs and a public and trusted source for versions, a developer can use npm every day. Trust is rebuilt one pin at a time.
What we still don't know
This is a fast-moving story. We update the post as new facts land — and we'll flag it when we do.
Enjoyed this? Pay it forward
Five people forward this newsletter before they finish their coffee. Make it six.
