Post

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/20...

github.blogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…

13/8/26, 6:25 pm4 reposts25 likes

npm

@npmjs.com

13 Aug

Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.

Ray Gesualdo

@raygesualdo.com

14 Aug

Then please start supporting OIDC on more CI platforms! Bitbucket and Jenkins are both necessary for many companies outside the GitHub ecosystem.