npm staged publishing now supports creating new packages
By Steven Van ·
Automated workflows can create packages with stage-only tokens, while a maintainer must approve the first staged version before installation.
Automated workflows can now create npm packages without a manual first publish. GitHub’s update lets developers use npm stage publish with a local session or a granular access token, including a stage-only token.
Stage the first version for review
When a package does not yet exist, npm creates a publicly available placeholder version named 0.0.0-stage. The submitted version and its contents stay in the staged queue until a maintainer reviews and approves them.
Maintainers can inspect staged packages through the CLI or the Staged Packages tab on npmjs.com. Approval requires two-factor authentication through either interface before the submitted version becomes available to install. Submitting a package to staging does not require a 2FA prompt.
Supported packages and requirements
Package creation works for public scoped and unscoped packages, and private scoped packages. After creation, maintainers can manage package settings and configure trusted publishing.
The staged publishing documentation requires npm CLI 11.15.0 or later, Node 22.14.0 or higher, publish access and an npm account with 2FA enabled.
