npm: accounting for scanning before package availability

Publishing and installing are separate steps

On 28 July 2026, npm announced automatic package scanning before installation availability. Depending on the result, publication can proceed, await review or be blocked.

Reconsider a release journey

For a library used by several applications, our first check would distinguish successful upload from an actually retrievable version. A publication message should not be the only evidence used to trigger subsequent work.

We recommend checking installation from a clean environment using the expected version number. This observes actual availability and verifies that package contents match the prepared deliverable. Keep network errors separate from a package that is not yet available: the situations require different investigations.

Bound the waiting period

Automation should have a maximum waiting time and produce an understandable state when it expires. We would avoid blindly repeating publication. A registry check also does not replace reviewing dependencies, publication permissions and the files included in the package.

Official source.

Retrospective watch — July 2026.