Tag

#access-tokens

Tagged “access-tokens”

2 articles

npm's stage-only token scope puts a human between CI and the registry

GitHub added a Read and write (stage only) scope to npm granular access tokens. A workflow with the new scope can stage a package version for review, but it cannot publish; a maintainer has to approve the release through 2FA before it goes live.

Sep 19, 2026 · Tomás Vega Security & supply chain

npm walls off 2FA-bypass tokens from account and package management

As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.

Aug 1, 2026 · Tomás Vega