# More npm changes coming

**URL:** <https://discourse.nodered.org/t/more-npm-changes-coming/101572>\
**Category:** Developing Nodes\
**Created:** [31 July 2026 14:28 UTC](https://discourse.nodered.org/t/more-npm-changes-coming/101572 "2026-07-31T14:28:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [31 July 2026 14:28 UTC](https://discourse.nodered.org/t/more-npm-changes-coming/101572/1 "2026-07-31T14:28:07Z")

</div>

Quick head's-up:

> **[npm publish-time malware scanning and dual-use metadata - GitHub Changelog](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/)**
>
> As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

The new check takes some time so they are saying that there will be at least a 5 minute delay after publishing before the new version is actually live - currently it is pretty much instantaneous. It is also possible that published versions might get blocked.

* * *

You might also find this article useful:

> **[The secure way to release an npm package in 2026—Martian Chronicles, Evil...](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package)**
>
> How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [29 September 2026 14:28 UTC](https://discourse.nodered.org/t/more-npm-changes-coming/101572/2 "2026-09-29T14:28:46Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.