Why I Started Treating My Photos Like npm Packages

I’ve got two lives: daytime code, nighttime camera. So when I saw npm had added staged publishing, it clicked in a weird way. This wasn’t just for developers—it was a workflow I wished I had for my photos.

Here’s the gist: instead of pushing a package straight to the world, you put it in a queue, review it, then approve it. That small pause—that deliberate checkpoint—is exactly what I need when I’m about to hit “share” on a photo.

We’ve all been there. You snap something amazing, upload it, and then spot the dust speck or the crooked horizon. Too late. It’s out there.

The idea behind staged publishing

npm’s staged publishing adds a human approval step before a package goes live. The tarball sits in a queue—visible on the website and CLI—and a maintainer has to complete two-factor authentication to approve it. Staging itself doesn’t require 2FA, so automated pipelines aren’t blocked. It’s a speed bump, not a wall.

For photographers, the parallel is obvious. You import, you edit, and then you stage. The approval is your own critical eye.

But it’s not just about catching mistakes. It’s about giving yourself a chance to think: “Am I really happy with this?”

My own workflow: stage, review, approve

Lightroom has a collection system that works like staging. I made a collection called “To Review.” Every import goes there. Then I go through them one by one, flagging or starring. But I’ve taken it further: nothing gets exported until it’s been in that collection for at least a day.

That day makes a difference. You’d be surprised how many “great shots” look less great in the morning.

The npm CLI has commands like npm stage publish, npm stage list, and npm stage approve. For me, that translates to: import, sort, select. I used to do it manually, but having a formal system makes it consistent.

Security: protecting your work

npm introduced staged publishing after supply-chain attacks. Packages were published under legitimate names, and users downloaded them before anyone noticed. Staging doesn’t stop attackers, but it slows them down.

Photographers face similar threats. Your images can be stolen, edited, misattributed. A staged approach means you don’t rush. You take time to watermark, check metadata, make sure the file is the right size and format.

Adnan Khan, a security researcher, said all npm publishers should enable this feature. I’d say all photographers should have a similar review process.

But is it overkill?

Some developers think staged publishing is a band-aid. They argue it doesn’t solve the root problem—just slows the spread. One commenter said it only delays malicious packages.

For photographers, the criticism might be that it adds friction. You’re used to sharing instantly. Why add a delay?

Because I’ve regretted quick shares. A staged approach isn’t about being slow—it’s about being deliberate. And honestly, the extra day doesn’t hurt. Most photos aren’t time-sensitive.

Tools to automate the pipeline

npm supports OIDC for trusted publishing. Photographers can automate parts of the workflow too. For example, I have a script that checks image resolution, color profile, and file size before export. It’s saved me from uploading a 10MB file when I meant to send a web-sized one.

You could also use Dropbox or Google Drive to stage. Upload to a private folder, review on your phone, then move approved ones to a public folder.

Some photographers use a two-step process: edit in Lightroom, export to a proof folder, review proofs before sending to clients. That’s staged publishing in practice.

Not a cure-all

Staged publishing won’t make you a better photographer. It won’t guarantee your images never get stolen. But it does give you a moment to breathe.

In the npm community, there’s debate about making it mandatory. Adoption rates are low. For photographers, the choice is yours. But the habit of reviewing before sharing is a good one.

I’m not saying you need to install npm. But next time you’re about to post a photo, pause. Ask yourself: is this the best version? If not, stage it and come back later.

Your photography is a package. Treat it with the same care as a developer treats their code. Stage. Review. Approve. Then share.