Notifications
Clear all
Topic starter
02/08/2026 11:23 am
TL;DR: npm now freezes high-impact accounts for 72 hours after risky changes such as email swaps or 2FA recovery use, while allowing installs and downloads to continue, according to Aikido. The pattern shows registry-level controls are shifting from post-compromise cleanup toward limiting takeover paths that bypass CI and token safeguards.
NHIMG editorial — based on content published by Aikido: npm now freezes high-impact accounts after risky account changes
By the numbers:
- axios does about 100 million downloads a week.
Questions worth separating out
Q: What breaks when package publishing still depends on persistent maintainer privilege?
A: Persistent maintainer privilege lets an attacker convert a single session compromise into immediate release authority.
Q: Why do package registries need identity controls as well as malware scanning?
A: Malware scanning helps after code exists, but identity controls stop an attacker from publishing the code in the first place.
Q: How do security teams know whether their release identity model is working?
A: Look for whether sensitive account changes trigger containment, whether long-lived tokens have been removed, and whether critical releases require a separate approval path.
Practitioner guidance
- Freeze high-impact publish accounts on identity changes Alert and temporarily restrict publish, token, visibility, and membership actions when maintainer email or recovery settings change, so reviewers can verify the change before malicious releases land.
- Move high-trust packages to OIDC-backed publishing Replace long-lived publishing tokens with short-lived OIDC credentials scoped to CI workflows, and remove any tokens that can still be stolen from developer machines or build hosts.
- Require staged approval for critical releases Use a human approval step for packages with broad dependency impact, and make the approver distinct from the automated publishing path whenever possible.
What's in the full article
Aikido's full blog post covers the operational detail this post intentionally leaves for the source:
- A step-by-step breakdown of the axios compromise chain and why the registry only saw one part of it.
- The exact behaviour of npm's 72-hour read-only state for high-impact accounts after sensitive changes.
- Practical guidance on configuring stage-only trusted publishing and disabling tokens for CI releases.
- A short comparison of registry cooldowns, staged publishing, and trusted publishing as layered controls.
👉 Read Aikido's analysis of npm's 72-hour account freeze for high-impact packages →
npm account freezes and package takeover risk: are controls catching up?
Explore further
02/08/2026 12:40 pm
Registry account control is now an identity security problem, not just an AppSec problem. npm’s freeze model acknowledges that the most dangerous point in package compromise is often account recovery and publish authority, not code scanning after the fact. That matters because a registry can only defend what it can see, and maintainer identity changes are one of the few visible signals in a largely opaque attack chain. The practitioner conclusion is clear: package registries need identity-aware controls, not only malware detection.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when a stolen maintainer account pushes malicious packages?
A: Accountability sits with both the project maintainers and the organisation operating the publishing identity. Teams should define who owns package release rights, who can revoke them, and how quickly compromised publisher access can be removed. That governance belongs in access review and offboarding processes.
👉 Read our full editorial: npm account freezes show registry controls for package takeover
