GitHub introduces staged publishing and new install-time controls for NPM

GitHub has released two npm security features: staged publishing, which now requires maintainer approval before packages become installable, and new install-time control flags (--allow-file, --allow-remote, --allow-directory) that let developers restrict dependency sources. Both features are available in npm CLI 11.15.0 and work together to enhance supply chain security by preventing unauthorized package releases and controlling where dependencies can be installed from.