Monish Mohan

We are excited to announce two new features for a safer npm package ecosystem experience: and the npm code explorer. Stolen credentials are one of the main causes of data breaches. Safeguarding credentials can be a challenging task and the supply chain impact of a compromised token with broad permissions can be severe. To help npm maintainers more effectively manage their risk exposure to token compromise, we are introducing a granular access token type for npm.

As stewards of the npm registry, we take the security of npm seriously and have continued to introduce a number of changes to improve the security and trustworthiness of the registry. We’ve announced a number of changes over the last several months to improve the security of npm, like requiring two-factor authentication, streamlined login, and enhanced signing of artifacts.

The JavaScript community downloads over 5 billion packages from npm a day, and we at GitHub recognize how important it is that developers can do so with confidence. As stewards of the npm registry, it’s important that we continue to invest in improvements that increase developer trust and the overall security of the registry itself.