Summary
GitHub tightened npm security on July 31, 2026: granular access tokens configured to bypass 2FA can no longer perform sensitive account, organization, and package management actions such as creating or deleting tokens, changing package access or trusted publishing config, or managing org and team membership, closing a major credential-based attack surface.
What changed
npm now requires an interactive 2FA challenge for sensitive actions that 2FA-bypass granular access tokens could previously perform, including token creation and deletion, changes to package access, maintainers, or trusted publishing configuration, and org/team membership and package grant management; GitHub PATs, App tokens, and GITHUB_TOKEN are unaffected.
Why it matters
After repeated npm supply-chain incidents, removing 2FA-bypass tokens ability to mint tokens or add maintainers shrinks the blast radius of a leaked credential, a meaningful hardening of the registrys account-takeover surface with direct-publish restrictions signaled for January 2027.
Evidence excerpt
npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. This closes one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens and does not affect GitHub personal access tokens, GitHub App tokens, or GITHUB_TOKEN in Actions.