Tag

#2fa

Tagged “2fa”

2 articles

npm walls off 2FA-bypass tokens from account and package management

As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.

Aug 1, 2026 · Tomás Vega Supply chain security

npm v12 flips install-time to closed-by-default

npm v12 shipped as latest on July 8, 2026, with lifecycle scripts, git-URL dependencies and remote-URL dependencies all off by default at install time. Alongside it, the 2FA-bypass Granular Access Token starts a two-step retirement that ends direct publishes.

Jul 9, 2026 · Tomás Vega