Market & Regulation
npm Introduces Publish-Time Malware Scanning
GitHub Changeloghigh confidence
Why it matters
- →Enhances security by scanning for malware before packages are available for install.
- →Requires developers to declare dual-use content, promoting transparency.
- →May necessitate changes in publishing workflows to accommodate new delays.
npm has announced a new security measure that involves automatic malware scanning of packages at the time of publishing. This process introduces a delay of up to 15 minutes before packages are available for installation, depending on their content and size. Publishers of dual-use content must declare this in their metadata and provide a disclosure file, which could lead to further review. This initiative is part of npm's ongoing efforts to improve supply-chain security and requires developers to adapt their publishing processes accordingly.
Read originalThe story around this
Earlier coverage that leads up to this article, and what followed. Lines connect each piece to the closest one after it, converging here.
How we got here
- 1OpenAI Responds to TanStack Supply Chain Attack
OpenAI · May 13, 2026 · Background
- 2npm Enhances Security with Staged Publishing
GitHub Changelog · May 22, 2026 · Same story
More in Market & Regulation
© TechCrunch AIMarket & Regulationother
Judge allows NAACP lawsuit over xAI pollution to proceed
xAI's attempt to dismiss the NAACP's Clean Air Act lawsuit failed after a federal judge ruled that its gas turbines are not exempt mobile sources and that plaintiffs have standing. This legal setback confirms that AI infrastructure operators cannot bypass environmental permitting by classifying heavy industrial equipment as temporary or mobile. The ruling forces xAI to face scrutiny over air quality impacts at its Colossus data center, setting a precedent for how large-scale compute facilities are regulated under existing environmental laws.
TechCrunch AI
© TechCrunch AI