npm release hardening
Evil Martians keep your npm releases away from your dependencies, so a hacked package in your tree never gets near your publish credentials.
Evil Martians method
The recent npm attacks, including the Shai-Hulud worm and the TanStack compromise, published malware under trusted package names. Shai-Hulud spread through infected dependencies: once installed on a maintainer’s laptop or in CI, it took the npm token it found there. Other attacks got in through a hacked third-party CI action or a poisoned CI cache.
You can start for free. The secure way to release an npm package in 2026 walks through the whole setup, and one command hands it to your coding agent: npx skills add https://evilmartians.com --skill secure-npm-package.
No time to do it yourselves? In one week, Andrey Sitnik and our engineers send a pull request to your release setup and walk your team through it. The week covers three things.
Keep the release away from node_modules. The publish job installs nothing and runs apart from the build. Local work moves into a Dev Container, install scripts stay off, and new dependency versions wait out a cooldown. You also get a list of dependencies to swap for zero-dependency alternatives.
Make a CI release at least as safe as one from a laptop with a hardware key. Publishing comes from CI only, with npm tokens disallowed. A maintainer approves each staged release with a hardware key. Third-party actions are pinned by commit and checked with zizmor, and only admins can cut a release tag.
Show your users what they install. Every release carries npm provenance, so anyone can check it was built from your repo. Provenance mostly protects your users, and they notice the green check on npmjs.com.
Shipping an SDK that thousands of apps install?
Social proof
PostCSS, Nano ID, Browserslist, Autoprefixer
Andrey Sitnik, our principal frontend engineer, created PostCSS and Autoprefixer and maintains Nano ID and Browserslist. Together they get over 1 billion downloads a week, so a single bad release would reach millions of projects. Their releases now ship from CI with npm provenance, from a publish job that installs no dependencies, and Andrey wrote down the whole setup so other maintainers can copy it.