ST-2026-040 · Authentication & identity
npm granular access tokens that bypass 2FA lose sensitive operations
GitHub is removing acceptance of npm granular access tokens configured to bypass 2FA for sensitive account and organisation operations, followed later by direct package publishing.
Previous state
Granular access tokens configured to bypass 2FA could perform named sensitive account, organisation and publishing operations.
Current state
Sensitive account and organisation operations reject bypass-enabled tokens in early August 2026, with direct package publishing following around January 2027.
Affected users
Who needs to care
npm maintainers, organisation owners and automation using granular access tokens with 2FA bypass.
Required response
What to do
Inventory bypass-enabled tokens, move sensitive workflows to supported authentication and prepare publishing automation for the later restriction.
Evidence boundary
What the source does not prove
GitHub gives approximate early-August and January windows rather than exact universal dates. This is distinct from npm v12 install-time security defaults.
Lifecycle history
Dated event sequence
- Change documented
GitHub is removing acceptance of npm granular access tokens configured to bypass 2FA for sensitive account and organisation operations, followed later by direct package publishing.
- Effective milestone
Sensitive account and organisation operations reject bypass-enabled tokens in early August 2026, with direct package publishing following around January 2027.
Evidence ledger
First-party sources
- 01GitHub Changelog — npm install-time security and GAT bypass2FA deprecation
Official product documentation or changelog · 2026-07-08
Open official source ↗