Developers followed our documentation, installed our JavaScript SDK into new projects, and received a beta whose authentication configuration no longer matched the instructions. The cause was a release default we had not checked: in Sergey Shinder’s account of the incident, publishing the prerelease without an explicit dist-tag left it as the package’s latest version. The account says the beta was exposed to fresh installs for five days; existing customers on version ranges such as ^3.4.0 remained on v3. (Shinder’s account on DEV Community.)
Why new projects received the beta
In April, the team began work on version 4 of its SDK, which changed authentication configuration. Three customers were invited to try it, so the team published 4.0.0-beta.1. The release workflow ran npm publish without explicitly assigning a prerelease dist-tag. Shinder reports that the registry consequently treated the beta as latest, the tag used for installs that do not specify a version.
As an Amazon Associate I earn from qualifying purchases.
That made the incident asymmetric. A developer starting a new project and installing without a version could receive the beta, while an existing project declaring a range such as ^3.4.0 stayed on v3. The docs still described the older authentication configuration, so following them with a fresh install produced a mismatch. Shinder says the beta was exposed for five days and support received “a handful of tickets”; these are the author’s reported figures, not independently audited counts.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the team changed immediately
The team moved the registry’s latest tag back to the stable release 3.4.2 with npm dist-tag add. This corrected which version ordinary unversioned installs selected, without requiring existing customers to change their version ranges.
#1 Best Overall
How to keep stable and prerelease installs separate
The incident led to a two-track release convention: stable releases belong on latest; prereleases intended for early testing belong on next. The distinction matters only if the publishing process assigns the intended tag and verifies the result.
| Release track | Intended audience | Tag and check |
|---|---|---|
| Stable | Ordinary installs | Assign latest, then read the registry’s dist-tags back after publishing. |
| Prerelease | Early testers | Assign next explicitly; block a prerelease publish if no tag is provided. |
Shinder’s account describes adding a guard against prerelease publishes without an explicit tag, checking the tags in the registry after each publish, and restricting the publishing token to the release workflow. It also describes identifying which SDK version each documentation page covers. These controls address different failure points: choosing the tag, preventing an ambiguous release, noticing a wrong registry state, limiting who or what can publish, and helping readers match instructions to a version.
What to check when a fresh install unexpectedly gets a beta
- Check the resolved package version. Compare the version installed in the new project with the version the documentation expects.
- Inspect the registry dist-tags. Confirm that
latestpoints to the stable version and that any testing prerelease has its intended tag. - Correct the tag deliberately. If a stable release should be the default, restore that release to
latestwithnpm dist-tag add, as the team did with3.4.2. - Make the next publish explicit. Assign prereleases to
next, require a tag for prerelease publishing, and have the workflow verify registry tags after publish. - Align documentation and access. State which SDK version a page describes and limit the publishing credential to the release workflow.
What this incident does—and does not—show
This is one team’s account of a release process failure, not evidence that npm packages generally expose betas this way. The causal details, customer count, duration, and support description here are attributed to Shinder’s October 2, 2026 DEV Community post. The account was not independently verified, and the article does not establish an independent test of the revised workflow.
Recommended Free Tools
Quick Recap
Rank #4
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
