npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks

GitHub has made staged publishing generally available on npm, requiring a human maintainer to approve package releases via a 2FA challenge before they become installable; the update is intended to provide proof-of-presence for publishes (including CI/CD and OIDC-based workflows). The release also adds three --allow- install-source flags (--allow-file, --allow-remote, --allow-directory) to control non-registry install sources. The article frames these changes as mitigation against a recent surge in software supply-chain attacks and mentions the group TeamPCP as an example of recent package-poisoning activity.