Latest is an npm dist-tag, an alias for a version number. When you run npm install with a package name and no version or tag, npm installs whatever latest points to. A publisher with the right access can move that tag, so unpinned installs can change without any change in your repository.
What dist-tags are
The npm documentation defines dist-tags as aliases for package versions. You can use one in place of a version number, as in the package name followed by at sign and the tag. The dist-tag command adds, removes and lists them.
The docs say latest is the tag npm uses by default to identify a package's current version, and publishing sets it unless the publisher passes a different tag. Other than latest, no tag has any special significance to npm itself. A tag called next, for example, is only a convention for an upcoming version.
Why security teams care
Two things follow from those rules.
An unpinned install is a bet on whoever controls the tag. Normally that is fine. After a maintainer account takeover, an attacker who publishes a new version sets latest to it, and everyone installing without a pin gets it. This is part of why dependency cooldown policies exist.
Tag moves are also a response tool. Publishers can point latest back to an earlier good version. The docs note that publishers with two-factor authentication on writes need a one-time password for tag commands, which is one reason to keep that setting on.
How to protect your installs
- Commit a lockfile and install from it in CI, so latest does not matter for resolved packages.
- Avoid the literal word latest as a version in package.json. It turns a pinned file into a floating one.
- When adding a new dependency, read the version npm chose and record it deliberately.
- For tools you run with npx, include a version in the command.
- Consider a minimum release age for newly published versions.
| What you write | What npm installs |
|---|---|
| Name only, no lockfile | The version latest points to now |
| Name at latest | Same, re-evaluated each fresh resolve |
| Exact version | That version |
| Name with lockfile and clean install | The version recorded in the lockfile |
Common mistakes
One mistake is treating latest as a safety signal. It only says what the publisher pointed the tag at. Another is writing latest as the version in package.json, which makes a pinned file float again. A third is forgetting that a lockfile only covers what was already resolved: when you add a new package or delete the lockfile, npm reads the tag afresh. During an incident, check the version history and the tag, not only the tag, since a good version may sit just below a bad one.
Quick check
Is latest always the highest version number?
Not necessarily. It is whichever version the publisher tagged as latest. Publishing sets it by default, but a publisher can tag a different version.
Does a lockfile protect me from tag changes?
For packages already resolved, yes. A clean install uses the versions recorded in the lockfile, not the current tag.
Safeguard monitors your dependency inventory for new advisories and malicious versions after you install, and the free scan at gold.safeguard.sh/scan shows what you resolve today.
Sources
Last reviewed: 19 October 2026.
