GitHub adds publish-time malware scanning and dual-use metadata rules for npm packages

GitHub is adding a new checkpoint to the npm registry: packages will be scanned for malware after publication is submitted but before the version becomes available for installation. The July 28 changelog frames the move as part of GitHub's broader supply-chain security work, and it changes an assumption many JavaScript release pipelines have relied on for years: a successful publish command no longer necessarily means the package can be installed immediately.

Under the new process, GitHub says newly published npm packages may proceed normally, be held for manual review, or be blocked. The company describes a typical availability delay of about five minutes, with longer waits of 15 minutes or more possible during peak periods or for larger and more complex packages. That makes the operational impact relatively small for most maintainers, but it matters for release automation, smoke tests, deployment scripts, and documentation steps that immediately install the exact version that was just pushed.

What maintainers need to change

For ordinary packages, the main adjustment is tolerance for a short pending period. GitHub says npm dist-tag operations continue while scanning is pending, but commands that depend on the new version being available, including npm deprecate and npm unpublish, will not work until the package clears the availability step.

The more substantial change applies to so-called dual-use packages: legitimate tools with security-relevant capabilities that can resemble malware to automated systems. GitHub is introducing a contentPolicy field in package.json and requiring a plain-text DISCLOSURE file in the package root to explain the functionality and intended legitimate use. The company says this metadata can trigger additional automated scanning and possible Trust & Safety review, and it does not guarantee publication.

• Dual-use packages must be published through a method that enforces two-factor authentication, such as trusted publishing, an interactive 2FA session, or staged publishing.
• Once a package declares dual-use content, future versions must keep the declaration and disclosure file.
• GitHub says enforcement will be progressive and that maintainers who need to add metadata will be contacted by email.

The timing reflects a larger defensive push around open source package and CI/CD abuse. In a companion security post, GitHub describes recent supply-chain attacks as campaigns that compromise accounts or workflows, spread through package repositories, and attempt to steal credentials for further exploitation. Publish-time scanning is not a complete answer to that problem, but it places a review gate at one of the highest-impact points in the npm ecosystem: the moment a new package version becomes installable by downstream users.

Sources

• github.blog
• github.blog

Cover photo by Harold Vasquez on Pexels, used under the Pexels License.