ReleaseBytes
github GitHub Changelog ·

npm restricts granular access token ability to bypass 2FA for sensitive actions

securitygovernanceengineer
security patch

npm granular access tokens (GATs) configured to bypass two-factor authentication (2FA) can no longer perform sensitive account, organization, and package management actions. This change closes a significant attack vector where leaked tokens could be used for account takeovers. The restriction impacts only npm granular access tokens and requires users to perform these actions interactively with a 2FA challenge.

  • →npm GATs with 2FA bypass restricted from sensitive actions
  • →Upcoming removal of 2FA bypass for publishing, recommend trusted publishing
  • →Guidance for preparing for upcoming changes
Security (1) ›
  • npm GATs with 2FA bypass restricted from sensitive actions

    npm granular access tokens (GATs) configured to bypass 2FA will now require an interactive 2FA challenge for actions like creating/deleting tokens, changing package access, or managing organization membership. This change addresses a credential-based attack surface on the npm registry.

Deprecations (1) ›
  • Upcoming removal of 2FA bypass for publishing, recommend trusted publishing

    Starting January 2027, 2FA-bypass tokens will also lose the ability to publish directly, only allowing reading private packages and staging publishes for maintainer approval. Users should migrate automated publishing to trusted publishing (OIDC) or staged publishing workflows.

Notes (1) ›
  • Guidance for preparing for upcoming changes

    Users are advised to stop using 2FA-bypass tokens for sensitive operations and perform them interactively. For future publishing changes, migrate to trusted publishing or staged publishing to avoid disruption.

Read the original announcement →

https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens

Related releases