PostCSS Adopts Staged Publishing, Gating 685M Weekly npm Downloads Behind Human Approval

Following a GitHub issue filed on June 18, 2026, PostCSS maintainer Andrey Sitnik began rolling out npm's Staged Publishing feature across his high-impact packages, which collectively account for over 900 million weekly downloads. The change was prompted by concerns that CI-based publishing — where automated pipelines hold publish credentials — creates a broad attack surface, as demonstrated by the TanStack compromise in May 2026 and a Red Hat incident on June 1, both exploiting CI tokens to push malicious packages with valid provenance attestations. Staged Publishing addresses this by allowing CI to build and stage a release while requiring a human to manually approve promotion to the 'latest' tag, meaning a stolen CI token alone cannot complete a malicious publish. Within nine days of the initial issue, four packages — PostCSS, nanoid, browserslist, and Autoprefixer — had Staged Publishing enabled, covering 685 million weekly downloads. Three remaining packages, caniuse-lite, postcss-nested, and postcss-js, have yet to adopt the feature, after which the entire ecosystem's roughly 963 million weekly downloads will sit behind a human approval gate.