# npm release hardening

> Evil Martians keep your npm releases away from your dependencies, so **a hacked package in your tree never gets near your publish credentials**.

- URL: https://evilmartians.com/services/npm-release-hardening
- Skills: JavaScript, Node.js

---

---

*Our open source gets over 1 billion npm downloads a week. Book a free 30-minute call to review how your packages get published.* [Contact Evil Martians](https://evilmartians.com/contact-us)

---

## Evil Martians method

The recent npm attacks, including the Shai-Hulud worm and the TanStack compromise, published malware under trusted package names. Shai-Hulud spread through infected dependencies: once installed on a maintainer's laptop or in CI, it took the npm token it found there. Other attacks got in through a hacked third-party CI action or a poisoned CI cache.

You can start for free. [The secure way to release an npm package in 2026](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package) walks through the whole setup, and one command hands it to your coding agent: `npx skills add https://evilmartians.com --skill secure-npm-package`.

No time to do it yourselves? In one week, [Andrey Sitnik](https://evilmartians.com/martians/andrey-sitnik) and our engineers send a pull request to your release setup and walk your team through it. The week covers three things.

**Keep the release away from node_modules.** The publish job installs nothing and runs apart from the build. Local work moves into a Dev Container, install scripts stay off, and new dependency versions wait out a cooldown. You also get a list of dependencies to swap for zero-dependency alternatives.

**Make a CI release at least as safe as one from a laptop with a hardware key.** Publishing comes from CI only, with npm tokens disallowed. A maintainer approves each staged release with a hardware key. Third-party actions are pinned by commit and checked with [zizmor](https://github.com/zizmorcore/zizmor), and only admins can cut a release tag.

**Show your users what they install.** Every release carries [npm provenance](https://docs.npmjs.com/generating-provenance-statements), so anyone can check it was built from your repo. Provenance mostly protects your users, and they notice the green check on npmjs.com.

Shipping an SDK that thousands of apps install? [Book a free 30-min call today](#book-a-call).

## Social proof

### PostCSS, Nano ID, Browserslist, Autoprefixer

The full setup, step by step: [The secure way to release an npm package in 2026](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package).

[Andrey Sitnik](https://evilmartians.com/martians/andrey-sitnik), our principal frontend engineer, created [PostCSS](https://evilmartians.com/opensource/postcss) and [Autoprefixer](https://evilmartians.com/opensource/autoprefixer) and maintains [Nano ID](https://evilmartians.com/opensource/nanoid) and [Browserslist](https://evilmartians.com/opensource/browserslist). Together they get over 1 billion downloads a week, so a single bad release would reach millions of projects. Their releases now ship from CI with npm provenance, from a publish job that installs no dependencies, and Andrey wrote down the whole setup so other maintainers can copy it.