npm now scans every newly published package before anyone can install it

npm has turned on automatic malware scanning at publish time. New packages are scanned before becoming available and may be published normally, held for manual review, or blocked. The typical added delay is about five minutes and can exceed 15 at peak. Blocked publishers can appeal, and repeat findings can affect the maintainer account. A new metadata requirement covers legitimate dual-use packages whose security capabilities resemble malware to an automated scanner.

What it means Any release automation that installs its own package immediately after publishing will now intermittently fail - a one-line assumption in a lot of pipelines that has just stopped being true.