/ Blog Changelog Docs Customer stories Try GitHub Copilot CLI Attend GitHub Universe Search Changelog Docs Customer stories Attend GitHub Universe Try GitHub Copilot CLI Back to changelog Release July 28, 2026 • 2 minute read npm publish-time malware scanning and dual-use metadata Table of Contents Packages are scanned before they become available Blocked packages and appeals New metadata requirement for dual-use content Publishing requirements for dual-use packages Menu. Currently selected: Packages are scanned before they become available Packages are scanned before they become available Blocked packages and appeals New metadata requirement for dual-use content Publishing requirements for dual-use packages As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement for dual-use content.
Newly published packages will be automatically scanned before they become available for install. Depending on the results, a package may be published as normal, held for manual review, or blocked.
This introduces a short delay between publishing and availability, typically around five minutes. It may take longer, up to 15 minutes or more, at peak times or depending on a package’s content and size. These times reflect current typical behavior and may change as scanning evolves; they aren’t a service guarantee.
For most publishes, no action is required beyond allowing for this brief delay. If you have automation that assumes a package is installable immediately after publishing, update it to tolerate a short availability delay.
While scanning is pending, the npm dist-tag command continues to work. Other operations that depend on the published version, such as npm deprecate and npm unpublish, will not work until the package becomes available.
This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: github.blog.
