Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Developers who followed our documentation installed a beta SDK with a different authentication configuration than the docs described. The problem was limited mainly to new installations: existing customers on version ranges such as ^3.4.0 stayed on version 3. In Sergey Shinder’s account of the incident, a version 4 beta became the registry’s default because the publish workflow did not specify a prerelease dist-tag.
How a beta reached ordinary installs
In April, the team began work on version 4, which changed the SDK’s authentication configuration. They published 4.0.0-beta.1 so three customers could test it. According to Shinder’s account, the publishing workflow ran npm publish without an explicit prerelease dist-tag. He says the registry assigned the beta the latest tag.
That distinction mattered for a fresh install that did not request a particular version: it received the version associated with latest, which was now the beta. A developer could follow the documentation correctly and still get a package whose authentication setup did not match it. Shinder reports that the beta remained exposed for five days and support received “a handful of tickets”; those are figures and descriptions from his account, not independently audited measurements.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy existing customers were less affected
Customers whose projects already requested a range such as ^3.4.0 remained on version 3. Their version constraint did not move them to version 4. As a result, the mismatch was concentrated in fresh installations rather than appearing immediately across the existing customer base.
#1 Best Overall
The incident illustrates two different ideas: a package can have a newly published version, while the version intended for routine installation is selected by a dist-tag. Publishing a prerelease is not, by itself, a sufficient signal that it should be excluded from ordinary installs. This explanation reflects Shinder’s account of this incident; it is not an independent confirmation of npm’s current default behavior.
How the team corrected the default
Shinder says the immediate fix was to point latest back to the stable version 3.4.2 with npm dist-tag add. The correction restored the intended version for installs using the default tag; it did not require existing customers with pinned version ranges to change their projects.
Release controls described after the incident
The account describes several safeguards intended to make release intent explicit and catch a bad default before it persists:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Separate stable and prerelease tracks. Assign stable releases to
latestand prereleases tonext, so early testing is distinct from the default install track. - Require an explicit tag for prereleases. Add a publishing guard that refuses a prerelease publish unless the workflow specifies its intended dist-tag.
- Verify the registry state after publishing. Read the dist-tags back from the registry and check that they point to the expected versions, rather than treating a successful publish command as proof that the release is routed correctly.
- Limit publishing credentials. Restrict the publishing token to the release workflow instead of making it broadly available.
- Identify the SDK version in documentation. Make clear which SDK version each documentation page covers, so readers can spot a version mismatch before following instructions.
These measures address different failure points: release-track assignment sets the intended audience, a guard makes intent mandatory, and a registry read-back checks the outcome. The restricted token limits who or what can publish; version labels in docs help users identify whether instructions apply to the package they installed. The account describes these as later controls, but does not provide an independently tested result for the revised workflow.
Rank #3
Source and scope
This incident report is based on Sergey Shinder’s first-person account, “Our beta became the version every new customer installed”, published on DEV Community and shown as posted October 2, 2026. The reported customer count, exposure period, and support response come from that account; the page was not independently retrievable for verification. The incident is useful as a release-engineering example, but it does not establish how often this happens across npm packages.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
