Restricting npm bypass-2FA granular access tokens - GitHub Changelog

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry.

This only impacts npm granular access tokens. This does not affect GitHub personal access tokens, GitHub App tokens, or GITHUB_TOKEN in Actions.

What now requires an interactive 2FA challenge

Creating or deleting tokens

Changing package access, maintainers, or trusted publishing configuration

Restricting npm bypass-2FA granular access tokens - GitHub Changelog

Other newsrooms on this story

Related reading

npm walls off 2FA-bypass tokens from account and package management

npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain…

npm adds preventive account protection for high-impact accounts - GitHub…

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks