npm.im
External Program
Submit bugs directly to this organization
[#search-box-input](Skip to search)[#skip-to-content](Skip to content)
Table of contents Outlined in this document are the practices and policies that npm applies to help ensure that we release stable/secure software, and react appropriately to security threats when they arise.
[#reporting-security-problems-to-npm](Reporting Security Problems to npm)
[#security-point-of-contact](Security Point of Contact)
[#critical-updates-and-security-notices](Critical Updates And Security Notices)
If you need to report a security vulnerability. Please visit https://npmjs.com/support. If your issue is specific to your account, such as lost credentials or problems with two-factor authentication, contacting [https://npmjs.com/support](our support team) is more appropriate.
We review all security reports on the next business day. Note that the npm staff is generally offline for most US holidays, but please do not delay your report! Our off-hours support staff can fix many issues, and will alert our security point of contact if needed.
Any security tickets opened using https://npmjs.com/support will be escalated to the security point of contact, who will delegate incident response activities as appropriate. This is the best and fastest way to contact npm about any security-related matter.
We learn about critical software updates and security threats from a variety of sources:
Ubuntu's security notices page: https://usn.ubuntu.com/
The Node.js mailing list.
[https://npmjs.com/support](Security tickets) sent to us.
and other media sources.
This is a living document and may be updated from time to time. Please refer to the [https://github.com/npm/documentation/blob/main/content/policies/security.mdx](git history for this document) to view the changes.
This document may be reused under a [https://creativecommons.org/licenses/by-sa/4.0/](Creative Commons Attribution-ShareAlike License).