npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing.

npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box. We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇

super npm packages you should use for every project! I had to work in a repo still on npm, typescript 5, and eslint 9. it is super slow to work with! ⇒ pnpm – replaces npm/yarn. faster installs, way less disk usage ⇒ typescript 7.x – 10x faster type-check and builds on large projects. ⇒ bun – replaces npm + node in one binary. insane install speed with built-in test runner and DB. ⇒ biome – replaces eslint + prettier. mucher faster, single config, no plugin hell. ⇒ tanstack start – lighter, faster alternative to next.js ⇒ shadcn/ui – replaces mui, chakra, mantine… copy-paste components, full control. ⇒ cn – 30x faster than clsx

Another npm worm: 1,485 poisoned versions, 379 packages, two intrusion paths. One via stolen tokens, another via compromised source/OIDC trusted publishing. The latter bypasses token rotation. This is the new reality: supply chain attacks exploiting *trusted* mechanisms. We've pushed out rules for Semgrep customers and listed the IoCs for those who aren't, read the blog:

Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed. We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default.