NPM Implements Pre-Publication Malware Scanning, But Will It Work?

The blog criticizes npm/GitHub's July announcement of pre-publication malware scanning as lacking technical detail (engine, start date, detection method, false-positive rates, appeal SLAs) and argues the feature mainly repositions an existing scanner to block earlier rather than improve detection. The author cites substantial ongoing malicious-package activity (daily malicious npm packages, mass campaigns like IndonesianFoods, and persistent known malicious packages), explains the practical limits of a ~5-minute publish-time budget (favoring fast static/signature checks and missing multi-stage, runtime-triggered, or off-tarball attacks), and warns that the dual-use metadata/`DISCLOSURE` requirement will burden legitimate researchers while attackers will simply avoid self-identifying.