Staged publishing for npm packages

Summary

Staged publishing adds an approval step before packages go live on the npm registry. Instead of publishing directly with npm publish, you can submit packages to a staging area with npm stage publish. A maintainer must then review and explicitly approve the staged package — with two-factor authentication (2FA) via the CLI or npmjs.com — before it becomes publicly available. Staged publishing is useful when you want an extra review step before a package version becomes available on the registry. Note: Staged publishing requires npm CLI version 11.15.0 or later and Node version 22.14.0 or higher. Staged publishing has three steps: Stage a package Review a staged package Approve a staged package Before using staged publishing, ensure the following: You have publish access to the package The package already exists on the npm registry — you cannot stage a brand-new package 2FA is enabled on your npm account On the command line, navigate to the root directory of your package. cd /path/to/package To stage your package, run: npm stage publish This submits your package to a staging area. Note: npm stage publish does not require 2FA. After you stage a package, you can inspect it in the CLI or on npmjs.com. To list staged packages you have access to: npm stage list [<package-spec>] To view details for a specific staged package: npm stage view <stage-id> To download the staged package tarball for inspection: npm stage download <stage-id> Open the Staged Packages tab to review staged packages and find the package you want to approve. To publish a staged package to the registry, approve it with 2FA. To approve a staged package and publish it to the live registry: npm stage approve <stage-id> On npmjs.com, review the staged package in the Staged Packages tab, then click Approve. Note: You will be prompted for 2FA verification whether you approve the package in the CLI or on npmjs.com. If you use trusted publishing (OIDC) from CI/CD, you can use staged publishing to submit a package...