As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an interactive 2FA challenge, and the same tokens are on a January 2027 timer to lose direct publish rights too.

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA…

As of July 31, npm granular access tokens configured to bypass 2FA can no longer perform sensitive account, organisation or package management actions. Those calls now demand an…