这个 npm 双用途内容政策（本_政策_）描述了 npm 如何处理发布到 npm 公共注册表的与安全相关的“双用途”内容，以及对发布这些内容的维护者适用的要求。本政策补充了 npm 开源条款 和 npm 可接受使用政策。文中未定义的大写术语，其含义以 npm 开源条款 中的定义为准。
🌐 This npm Dual-Use Content Policy (this Policy) describes how npm treats security-relevant "dual-use" content published to the npm Public Registry, and the requirements that apply to maintainers who publish it. This Policy supplements the npm Open Source Terms and the npm Acceptable Use Policies. Capitalized terms not defined here have the meaning given in the npm Open Source Terms.
npm 最近一次更新此政策是在 2026 年 7 月 28 日。
🌐 npm last updated this Policy on July 28, 2026.
🌐 What is Dual-Use Content
一些合法的包包含与安全相关的功能，这些功能在自动扫描中可能看起来像恶意软件。例如，渗透测试工具、安全研究工具、代码混淆工具以及类似的软件，它们的功能既有合法用途，也可能有潜在的有害用途。npm 把这称作“二重用途内容”。
🌐 Some legitimate Packages include security-relevant capabilities that can resemble malicious software to automated scanning. Examples include penetration-testing tools, security research utilities, code-obfuscation tools, and similar software whose capabilities have both legitimate and potentially harmful uses. npm refers to this as dual-use content.
npm 公共注册表允许双用途内容存在。这个政策的存在是为了让维护者能够声明这些内容，以便 npm 可以进行适合它的扫描，并确保合法的双用途包不会被默认阻止。
🌐 Dual-use content is permitted on the npm Public Registry. This Policy exists so that maintainers can declare such content, so that npm can apply scanning suited to it, and so that legitimate dual-use Packages are not blocked by default.
🌐 Why Declaration is Required
npm 就像 GitHub 一样，假设双用途内容背后有积极意图。需要声明是因为 npm 包通常会被自动安装和执行——通常作为传递依赖——而不是被浏览来进行研究。声明让 npm 能够区分合法的安全工具和恶意包，而不需要对每个发布的包进行人工审查。
🌐 npm, like GitHub, assumes positive intent behind dual-use content. Declaration is required because npm Packages are typically installed and executed automatically — often as transitive dependencies — rather than browsed for research. Declaration lets npm distinguish legitimate security tools from malicious Packages without requiring manual review of every publish.
本政策不允许恶意代码。即使根据本政策作出任何声明，任何本身就是恶意软件或主要目的是造成伤害的内容，仍然根据npm 可接受使用政策被禁止。
🌐 This Policy does not permit malicious code. Content that is itself malware, or that exists primarily to cause harm, remains prohibited under the npm Acceptable Use Policies regardless of any declaration made under this Policy.
🌐 Declaring Dual-Use Content
发布双重用途内容的维护者必须用两种方式声明。
🌐 Maintainers who publish dual-use content must declare it in two ways.
package.json 中的元数据🌐 1. Metadata in package.json
在 Package 的 package.json 中添加一个 contentPolicy 字段：
🌐 Add a contentPolicy field to the Package's package.json:
{"contentPolicy": {"class": "dual-use"}}
DISCLOSURE 文件🌐 2. A DISCLOSURE file
在包中包含一个 DISCLOSURE 文件，放在发布的 tar 包的根目录下，与 LICENSE 等文件一起。DISCLOSURE 文件是自由格式的文本。它应描述该包提供的双重用途功能及其预期的合法用途。
🌐 Include a DISCLOSURE file in the Package, at the root of the published tarball, alongside files such as LICENSE. The DISCLOSURE file is free-form text. It should describe the dual-use functionality the Package provides and its intended legitimate use.
npm 的信任与安全团队在审核双用途包时可能会使用 DISCLOSURE 文件。
🌐 npm's Trust & Safety team may use the DISCLOSURE file when reviewing dual-use Packages.
🌐 Effect of Declaring Dual-Use Content
声明双用途内容可能会在需要时触发适用于双用途内容的额外自动扫描。
🌐 Declaring dual-use content may trigger additional automated scanning suited to dual-use content when needed.
声明双用途内容并不意味着自动获得发布权限。npm 的信任与安全团队可能会根据 npm 可接受使用政策 的规定，逐案审查双用途包。
🌐 Declaring dual-use content does not automatically grant publication. npm's Trust & Safety team may review dual-use Packages on a case-by-case basis, consistent with the npm Acceptable Use Policies.
🌐 Publishing Requirements for Dual-Use Packages
以下要求适用于声明双用途内容的软件包。在所有情况下，发布都必须执行双因素认证——要么在发布时（互动式），要么在提升时（分阶段）。
🌐 The following requirements apply to Packages that declare dual-use content. In every case, publishing must enforce two-factor authentication — either at publish time (interactive) or at promotion (staged).
🌐 Acceptable publishing methods
🌐 Publishing methods that are not permitted
简而言之：双用途软件包只能通过交互式的双因素认证会话直接发布。所有其他方法——包括受信任的发布和绕过双因素认证的令牌——都必须通过分阶段发布。
🌐 In short: a dual-use package may be published directly only through an interactive, two-factor-authenticated session. All other methods — including trusted publishing and bypass-2FA tokens — must go through staged publishing.
🌐 Persistent declaration
一旦一个包发布时带有双用途元数据，这个声明必须在各个版本中保持不变。新版本的包不能移除 contentPolicy 字段或 DISCLOSURE 文件。移除它们的发布可能会被拒绝。要移除双用途声明，需要 npm 的信任与安全团队进行审核。
🌐 Once a Package is published with dual-use metadata, the declaration must persist across versions. New versions of the Package may not remove the contentPolicy field or the DISCLOSURE file. Publishes that remove them may be rejected. Removing a dual-use declaration requires review by npm's Trust & Safety team.
🌐 Enforcement
npm 正在随着时间推行这一政策。npm 会直接通过电子邮件联系那些需要添加这些元数据的双用途包的维护者，以避免被默认阻止。
🌐 npm is enforcing this Policy progressively over time. npm is reaching out directly by email to maintainers of dual-use Packages that need to add this metadata to avoid being blocked by default.
npm 会阻止它能检测到的恶意软件，并继续努力提高检测覆盖率和减少扫描时间。关于在 npm 公共注册表上允许或不允许的内容，请参见 npm 可接受使用政策。
🌐 npm blocks the malware it can detect and continues to work to improve detection coverage and reduce scan time. For what is and isn't permitted on the npm Public Registry, see the npm Acceptable Use Policies.
npm 在决定哪些内容可以接受时会继续运用自己的判断力，并希望你在选择发布内容时也能运用自己的判断力。本政策中的示例是用来说明的，并非全部列举。
🌐 npm will continue to apply its judgment when deciding what content is acceptable, and expects you to apply your own judgment when choosing what to publish. The examples in this Policy are illustrative, not exhaustive.
🌐 Questions
跟着一起看，并在社区讨论中提问。
🌐 Follow along and ask questions in the community discussion.
你可以将关于 npm 产品和服务政策的问题发送到 legal-support@github.com。
🌐 You may send questions about the policies governing npm products and services to legal-support@github.com.