npm adds staged publishing to force 2FA approval before packages go live
Staged publishing adds a human gate: a maintainer must approve a package version with two‑factor authentication before it becomes installable. This blocks accidental or malicious releases, tightening supply‑chain security for the Node.js ecosystem and integrating with trusted publishing in CI/CD pipelines.