Restricting npm bypass-2FA granular access tokens

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions — these now require an interactive 2FA challenge. Actions blocked include creating/deleting tokens, changing package access or maintainers, and managing org/team membership. This closes a major attack vector where a leaked bypass token could be used to take over an account. Looking ahead, 2FA-bypass tokens will also lose direct publish capability by January 2027, with npm recommending migration to trusted publishing (OIDC) or staged publishing.

Source: https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.