Likes from 21 May 2026

thank @leobalter.bsky.social - he's the hero we (and microsoft) doesn't deserve if staging had shipped in 2020, shai hulud would never have happened.

npm staged publishing has shipped 🎉 Your CI can now stage a publish without 2FA, but a human still has to approve it with a hardware key before anything goes live on the registry. Stolen npm tokens stop being game over. Big deal for the Shai-Hulud class of worm. https://docs.npmjs.com/staged-publishing