--- title: "npm to scan packages for malware at publish time" publication: "Node Weekly" issue: 635 published_at: "2026-07-30" canonical_url: "https://nodeweekly.com/issues/635" --- Plus a beta of Node's new docs site, new Node security releases, and how to securely release an npm package in 2026. #​635 — July 30, 2026 [Read on the Web](https://nodeweekly.com/issues/635) Together with [![Render\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_500,h_100/e_make_transparent/co_white,e_outline:7/bil3olyaqqkao0fkbhis.png)](https://dashboard.render.com/register?utm_source=email&utm_medium=newsletter&utm_campaign=2026_newsletter_cooperpress&utm_content=nodejs_weekly) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/un7lnngivo4dfpog3r24.jpg)](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package) [The Secure Way to Release an `npm` Package in 2026](https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package) — A practical guide to publishing `npm` packages more safely in 2026, written by someone who's released several popular packages (like [postcss](https://www.npmjs.com/package/postcss) and [nanoid](https://github.com/ai/nanoid)). As well as showing _how_ to use things like staged publishing and trusted publishing, he explains _why_ and the security benefits of doing so. Andrey Sitnik [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/d4838d18.jpg)](https://dashboard.render.com/register?utm_source=email&utm_medium=newsletter&utm_campaign=2026_newsletter_cooperpress&utm_content=nodejs_weekly) [Ship Node and Bun Apps in Minutes](https://dashboard.render.com/register?utm_source=email&utm_medium=newsletter&utm_campaign=2026_newsletter_cooperpress&utm_content=nodejs_weekly) — Link your repo and Render takes it from there, handling every build, deploy, and SSL cert. Loop in your agent with official Render `/plugins` for Codex and Claude Code. Start free and scale from there. Render sponsor [npm to Scan Every Package For Malware at Publish Time](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/) — The npm registry is beginning to scan packages at publish time, meaning new versions can take several minutes to become installable, and _could_ be held or blocked. GitHub **IN BRIEF:** - 🔒 The [Wednesday, July 29, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases) of Node are available as [Node v26.5.1](https://nodejs.org/en/blog/release/v26.5.1), [v24.18.1](https://nodejs.org/en/blog/release/v24.18.1) and [v22.23.2](https://nodejs.org/en/blog/release/v22.23.2). 11 CVEs are tackled, including two HTTP/2 flaws, a Permission Model allowlist bypass, and more. - Microsoft is previewing [a way to call native Windows APIs from Node](https://devblogs.microsoft.com/ifdef-windows/a-new-way-to-bring-native-windows-apis-to-javascript-introducing-dynamic-api-projections-for-node-js/) (and therefore Electron) _without_ native addons via a new dynamic Windows Runtime API (WinRT) projection. - [Amazon's security team has narrowed down](https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/) several npm supply chain attacks (such as those on `debug` and `chalk`) to a single North Korean-linked group. - Cloudflare's `wrangler` can now [run integration tests against Workers from any Node.js test runner](https://developers.cloudflare.com/changelog/post/2026-07-21-integration-test-harness/). [Check Out Node's New API Documentation Preview](https://nodejs.org/en/blog/announcements/new-api-docs-beta) — Node's official API docs have been getting redesigned (now sharing a design system with [nodejs.org](https://nodejs.org/en) itself) and have a new built-in search feature. You're invited to [try the preview here](https://beta.docs.nodejs.org/) and report what breaks. Guilherme Araújo (Node.js Team) [How GitHub Is Disrupting Supply Chain Attacks on npm and Actions](https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/) — Separate to the scanning news above, GitHub's team explains recent npm and Actions changes designed to mitigate supply chain attack techniques. Ose and Steindler (GitHub) 📄 [Finding Eight High-Severity Vulnerabilities in NodeBB in Six Hours](https://www.aikido.dev/blog/eight-high-severity-vulnerabilities-nodebb) Jorian Woltjer (Aikido) 📄 [Running `npm` in a Separate Container When Using Claude](https://nodogmablog.bryanhogan.net/2026/07/running-npm-in-a-separate-container-when-using-claude/) Bryan Hogan 📄 [Integration Testing with Node and Testcontainers](https://flaviocopes.com/nodejs-testcontainers/) Flavio Copes 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/q9tikaadsxmsj3f7vkpi.jpg)](https://scriptc.dev/) [scriptc: Vercel's New TypeScript-to-Native Compiler](https://scriptc.dev/) — A new entry into the growing field of JS/TS native ahead-of-time compilers that makes the promise that _"what compiles behaves byte-for-byte like Node."_ Static by default, but you can opt in to a `--dynamic` mode which embeds a JavaScript engine for runtime dynamism. [GitHub repo](https://github.com/vercel-labs/scriptc). Vercel Labs [Fast Endpoints Shouldn't Choke on Analytics](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter) — TimescaleDB extends Postgres so heavy queries stay fast at scale. One database, not two. [Get $1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=node-weekly-newsletter). Tiger Data (creators of TimescaleDB) sponsor [tslog 5: Zero-Dependency Logger for Node, Deno, Bun and Browsers](https://tslog.js.org/) — A ground-up rewrite that's now ESM-only. Pretty output by default, JSON optionally, plus middleware, file/HTTP/worker transports, secret masking, and error stacks that resolve through source maps to your `.ts` code. [GitHub repo](https://github.com/fullstack-build/tslog). Eugene Terehov [npm-check-updates 23.0: Find Newer Versions of Dependencies](https://github.com/raineorshine/npm-check-updates) — Find newer versions than your `package.json` allows. Has a `-i` interactive mode to look at upgrades and opt in to them one by one. Supports custom cooldown periods. [v23](https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.0) is faster, smaller, and is now a pure ESM package. Raine Revere [jsdom 30.0: Pure JS Implementation of Web Standards for Node](https://github.com/jsdom/jsdom) — The venerable browser-environment emulator used by countless test suites. v30.0 adds `CSS.escape()`, `CSS.supports()`, `background-position-x`/`y`, as well as some fixes. Denicola, Insua, et al. [crypto-random-string 6.0: Generate a Cryptographically Strong Random String](https://github.com/sindresorhus/crypto-random-string) — For example: `cryptoRandomString({length: 10})` might return `2cf05d94db`. v6.0 improves performance and removes `cryptoRandomStringAsync`. Sindre Sorhus - [Ada v4](https://www.yagiz.co/release-of-ada-v4) – The WHATWG-compliant URL parser used by Node is now even faster. - [Wasp v0.25](https://github.com/wasp-lang/wasp/releases/tag/v0.25.0) – The Rails-esque framework for building full-stack webapps with React & Node introduces Vite 8 and React Router 8. - [modern-tar 0.8](https://github.com/ayuhito/modern-tar) – Zero-dependency streaming `tar` parser and writer. - 📋 [tinyclip 1.0](https://github.com/tinylibs/tinyclip) – Cross-platform clipboard utility library. - [Nub 0.6](https://github.com/nubjs/nub/releases/tag/v0.6.0) – Fast all-in-one toolkit that augments Node. - [Verdaccio 6.9](https://github.com/verdaccio/verdaccio) – Self-hostable private npm registry. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).