This npm Dual-Use Content Policy (this Policy) describes how npm treats security-relevant "dual-use" content published to the npm Public Registry, and the requirements that apply to maintainers who publish it. This Policy supplements the npm Open Source Terms and the npm Acceptable Use Policies. Capitalized terms not defined here have the meaning given in the npm Open Source Terms.
npm last updated this Policy on July 28, 2026.
Some legitimate Packages include security-relevant capabilities that can resemble malicious software to automated scanning. Examples include penetration-testing tools, security research utilities, code-obfuscation tools, and similar software whose capabilities have both legitimate and potentially harmful uses. npm refers to this as dual-use content.
Dual-use content is permitted on the npm Public Registry. This Policy exists so that maintainers can declare such content, so that npm can apply scanning suited to it, and so that legitimate dual-use Packages are not blocked by default.
npm, like GitHub, assumes positive intent behind dual-use content. Declaration is required because npm Packages are typically installed and executed automatically — often as transitive dependencies — rather than browsed for research. Declaration lets npm distinguish legitimate security tools from malicious Packages without requiring manual review of every publish.
This Policy does not permit malicious code. Content that is itself malware, or that exists primarily to cause harm, remains prohibited under the npm Acceptable Use Policies regardless of any declaration made under this Policy.
Maintainers who publish dual-use content must declare it in two ways.
package.jsonAdd a contentPolicy field to the Package's package.json:
{"contentPolicy": {"class": "dual-use"}}
DISCLOSURE fileInclude a DISCLOSURE file in the Package, at the root of the published tarball, alongside files such as LICENSE. The DISCLOSURE file is free-form text. It should describe the dual-use functionality the Package provides and its intended legitimate use.
npm's Trust & Safety team may use the DISCLOSURE file when reviewing dual-use Packages.
Declaring dual-use content may trigger additional automated scanning suited to dual-use content when needed.
Declaring dual-use content does not automatically grant publication. npm's Trust & Safety team may review dual-use Packages on a case-by-case basis, consistent with the npm Acceptable Use Policies.
The following requirements apply to Packages that declare dual-use content. In every case, publishing must enforce two-factor authentication — either at publish time (interactive) or at promotion (staged).
In short: a dual-use package may be published directly only through an interactive, two-factor-authenticated session. All other methods — including trusted publishing and bypass-2FA tokens — must go through staged publishing.
Once a Package is published with dual-use metadata, the declaration must persist across versions. New versions of the Package may not remove the contentPolicy field or the DISCLOSURE file. Publishes that remove them may be rejected. Removing a dual-use declaration requires review by npm's Trust & Safety team.
npm is enforcing this Policy progressively over time. npm is reaching out directly by email to maintainers of dual-use Packages that need to add this metadata to avoid being blocked by default.
npm blocks the malware it can detect and continues to work to improve detection coverage and reduce scan time. For what is and isn't permitted on the npm Public Registry, see the npm Acceptable Use Policies.
npm will continue to apply its judgment when deciding what content is acceptable, and expects you to apply your own judgment when choosing what to publish. The examples in this Policy are illustrative, not exhaustive.
Follow along and ask questions in the community discussion.
You may send questions about the policies governing npm products and services to legal-support@github.com.