npm Now Scans for Malware at Publish, Not Install | Blog | Endor Labs

What it is

GitHub's July 28 change to npm: every published package is scanned for malware before going live, and a new governance regime for "dual-use" packages (pen-test tools, security research utilities, code obfuscators) whose behavior resembles malware. The summary states this exists; below is the mechanism a maintainer actually has to satisfy.

How it works

On publish, a package is scanned and, after roughly five minutes, one of three outcomes follows: released, held for human review, or blocked. This replaces the old reactive model (instant publish, takedown only after a report).

For dual-use content, GitHub's answer is governance, not a smarter model. Three requirements, all of which must hold:

• Declared in metadata — a contentPolicy field in package.json, plus a plain-text DISCLOSURE file in the package root describing the dual-use functionality and its legitimate purpose. npm's Trust & Safety team reviews declarations, with no guarantee of publication.
• 2FA-enforced publishing only — you must publish via trusted publishing (OIDC), an interactive 2FA session, or staged publishing. Publishing with a token that bypasses 2FA is not permitted.
• A one-way door — once a package declares dual-use status, later versions cannot remove the contentPolicy field or the DISCLOSURE file. Versions that drop them are rejected.

Preconditions / Affected

Matters to you if you publish or consume npm packages with security-relevant capabilities — credential access, network probing, obfuscation. The examples given: penetration-testing tools, security research utilities, code-obfuscation tools (Mimikatz is cited as the archetype). If you maintain such a tool, the declaration is now mandatory and irreversible for that package line.

What to do

The page's actionable takeaways split by role:

• Maintainers of dual-use tools: add contentPolicy and a DISCLOSURE file before publishing, switch to a 2FA-enforcing publish path (OIDC trusted publishing, interactive 2FA, or staged), and understand the declaration can never be removed.
• Consumers: the registry gate covers only npm and only GitHub's definition of malware — it cannot enforce your license rules, vulnerability thresholds, or new-package waiting periods, and doesn't cover PyPI, Maven, or NuGet. The recommended control is install-time enforcement with cooldown policies that keep brand-new, unvetted packages out of builds by default, applied uniformly to human developers and AI agents. (The vendor's product for this is Package Firewall; the general principle is layered enforcement at the install boundary.)

Caveats

GitHub explicitly states the limit — "npm blocks the malware we can detect." A five-minute scan will sometimes pass novel malware and compromised-maintainer-account publishes. The five-minute delay also only slows human publishers; AI agents pulling dependencies at machine speed see no equivalent review, which the page frames as the real multiplier.