Summary
GitHub added publish-time malware scanning to npm on July 28, 2026, screening packages as they are published and attaching dual-use metadata, tightening the registrys defenses against malicious packages entering the supply chain.
What changed
npm now scans packages for malware at publish time and records dual-use metadata on packages, adding an automated screening step to the publish pipeline rather than relying solely on post-hoc takedowns.
Why it matters
Publish-time scanning shifts npm supply-chain defense earlier, aiming to stop malicious or dual-use packages before they propagate to installers, an important layer as coding agents increasingly pull dependencies automatically.
Evidence excerpt
npm publish-time malware scanning and dual-use metadata: packages are scanned for malware as they are published, with dual-use metadata recorded.