was-staged-publish

Determine, from an npm packument, whether a published version was a staged publish — and therefore approved by a human passing a 2FA challenge.

Why?

Staged publishing shipped in npm v11.15.0 on 2026-05-20. It requires a maintainer to pass a two-factor-authentication challenge to approve a version before it goes live. That approval is the only signal that survives into a package's public metadata proving a second factor was involved in a release. This tool reads that signal.

What it can and can't tell you:

• ✅ Staged is detectable. Either _npmUser.approver is present (npm >= 11.16.0), or — in the original npm v11.15 window — the publish is missing dist.fileCount/dist.unpackedSize, which that flow dropped.
• ✅ Definitely not staged is detectable when the publish used npm < 11.15 (which cannot stage), predates 2026-05-20, or used npm >= 11.16.0 without an approver (the fixed flow always records one).
• ❓ The only unknown is an npm v11.15 publish with file stats present and no approver. A plain local publish with 2FA and one without are indistinguishable in a packument; staging is what finally made 2FA observable.

Staging and provenance are orthogonal: a publish can be built in CI via OIDC/trusted publishing and be staged. Such a publish is reported as staged, since unlike non-staged OIDC publishing, it uses 2FA.

CLI

npx was-staged-publish <pkg>[@<version>] [--registry <url>]

<version> may be an exact version or a dist-tag; it defaults to latest.

Exit codes:

| code | meaning | stream | | ---: | ------- | ------ | | 0 | staged (for sure) | stdout | | 1 | definitely not staged | stderr | | 2 | unknown (cannot be determined) | stderr | | 3 | usage or fetch error | stderr |

was-staged-publish [email protected]
# [email protected]: staged — `_npmUser.approver` is present: ...   (exit 0)

was-staged-publish [email protected]
# [email protected]: NOT staged — published ..., before staged publishing shipped  (exit 1)

was-staged-publish [email protected]
# [email protected]: unknown — published with npm 11.15.0 in the v11.15 window ...  (exit 2)