Lock down your npm package in 2026 with Trusted Publishing and Provenance
Supply-chain attacks on npm are now automating with LLMs, making every open-source package a potential entry point. Evil Martians’ guide shows how to harden releases in 2026—enable npm’s Trusted Publishing and Provenance, enforce 2FA, lock tag creation to admins, pin CI actions by SHA, impose a three‑day cooldown, and upgrade to npm 12‑compatible runtimes.