A token that skips 2FA is a bad idea (until you need one at 3am)
You automate your npm publishes with a token that skips the 2FA prompt, because robots do not punch codes into a phone. Then the token leaks. Now the attacker has your automation, your account settings, your maintainer list, and a fresh batch of tokens they minted for themselves on the way out. Comforting.
As of July 31, npm has cut the second half of that story off. Granular access tokens (GATs) configured to bypass 2FA can still do their day job, but they can no longer touch the account behind it. GitHub's changelog puts it plainly: a token that skips 2FA should not also be a way to manage the account.
What flipped over
Bypass-2FA GATs now hit an interactive 2FA challenge whenever they try to:
