Publish-time scanning + dual-use disclosure — feedback welcome

[leobalter]

Hi all 👋

We recently rolled out two supply-chain security changes on npm, and we'd like your feedback on how they're working in practice. This thread is for discussion — questions, friction, edge cases, and suggestions are all welcome.

Full details are in the changelog: https://gh.io/npm-publish-time-scanning

What changed, in short

1. Packages are scanned at publish time

Newly published packages are now scanned before they become available to install. Most publishes see a short delay (typically a few minutes) between publishing and availability. npm dist-tag keeps working during this window; commands that depend on the published version (like npm deprecate and npm unpublish) wait until the package is available.

If your automation assumes a package is installable the instant it's published, it may need to poll/retry for availability rather than assume a fixed delay.

2. Disclosure for dual-use content

Some legitimate packages (security research tools, pen-testing utilities, obfuscation tools, etc.) have capabilities that can look like malware to automated scanning. Maintainers of these packages can now declare them with a contentPolicy field in package.json and a DISCLOSURE file describing the intended use. This helps us distinguish legitimate security tooling from malicious packages without manually reviewing every publish.

We'd love your input

We're reading this thread and will use it to improve the rollout. Thanks for helping us make the ecosystem safer 🙏

[donecarlo]

Couple of questions about the topic:

• Does scanning only involve the source code, or does it also scan the package's dependencies for possible vulnerable versions?
• Is the scanning also applicable when publishing towards a private registry?

[davidwarner234]

Publish-time scanning is a good step toward making npm safer. The main concern will be how automation handles the delay, so clear status signals and reliable retry guidance would help. The disclosure process for legitimate security tools also sounds like a practical approach.

[trivikr]

Feedback on how should tooling tell "pending scan" apart from "never published"

This was posted before the link was shared in the blog post https://github.com/orgs/community/discussions/203395

[siddsriv]

Curious about the mechanics: 1. Will I be notified (and how?) if the scanning results in my package(s) not being published? 2. In case there are false positives and my package is not published owing to a potential security reason, is there an appeal process?

[kuhe]

If I publish [A] and [B depends-on A], (actually hundreds of these packages) in what normally was the correct dependency order, will they be held, scanned, & released in the right order?