Shipping an npm CLI Tool Securely to a Specific Customer — Designing the Build, Sign, and Deliver Pipeline

You want a privately developed npm CLI tool used only inside one customer enterprise, never on the public npm registry. It looks like plain packaging, but in practice you must satisfy three things at once: passing the OS security gates (Gatekeeper and SmartScreen), tamper-evident signing, and a distribution network you can control and audit per customer. Targeting macOS and Windows now with Linux ahead, this post designs build, signing, distribution, and supply-chain hardening as a single pipeline.

Distributing Windows Desktop Apps Through Customer Intune Tenants — A Software Vendor Playbook for Win32, MSIX, Code Signing, and Updates

If your customers use Microsoft Intune, almost every path to their Windows desktops in 2026 leads to the Win32 app format. LOB has narrow scope, Store for Business is gone, and MSIX only fits if your app is container-friendly. The vendor's job is to hand IT a signed MSI, an `.intunewin`, detection rules, ADMX templates, and silent install commands. This post lays out the software vendor playbook, including the geographic limits on Azure Artifact Signing (formerly Trusted Signing) that bite vendors based outside the US/EU.