--- title: "npm tokens that bypass 2FA can no longer manage accounts, packages or organizations: 2026-07-31 | Harbyn" description: "npm tokens that bypass 2FA can no longer manage accounts, packages or organizations, effective Jul 31, 2026." canonical: "https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-can-no-longer-manage-accounts-packages-or-orgs" last-updated: 2026-09-23 --- # npm tokens that bypass 2FA can no longer manage accounts, packages or organizations Markdown version of . Breaking change - npm. medium severity. In effect. History: recorded after the fact. Granular access tokens configured to bypass 2FA now need an interactive 2FA challenge to create or delete tokens, change package access, maintainers or trusted publishing configuration, and manage organization or team membership. Automation that did any of this with a token fails. Perform these actions interactively on the web or CLI. GitHub tokens and GITHUB\_TOKEN in Actions are not affected. The deadline passed on Jul 31, 2026. ## Facts | Fact | Value | | --- | --- | | Vendor | [npm](https://harbyn.com/vendors/npm.md) | | Product | registry | | Kind | Breaking change | | Severity | medium | | Status | In effect | | Announced | Jul 8, 2026 | | Effective | Jul 31, 2026 | | Added to Harbyn | Sep 23, 2026 | | Lead time | Recorded after the fact: added 54 days after the deadline | | Symbols | `NPM_TOKEN`, `NODE_AUTH_TOKEN` | | Vendor page | | | Review | Reviewed by a person, extracted by a person | ## Find it in your code ```sh npx harbyn scan ``` This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses npm, from its packages and API hosts. Nothing leaves your machine. ## Sources Where this event comes from: the page we read, when we read it, and the hash of that snapshot. - (changelog, fetched 2026-09-23 22:31 UTC, sha256 `466f09277e0b2ee35943080cfbe756e8f8ccc9ff9ba9ed68db7e0c4fbf8a3f43`) - (changelog, fetched 2026-09-23 22:31 UTC, sha256 `82b9798e49c9cc2561f3a84f1871f6acfd373f66ef9a30f43b370b1addd2fc97`) ## Related changes ### More from npm - [npm tokens that bypass 2FA will lose direct publishing](https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-lose-direct-publishing.md) (Breaking change, effective Jan 2027) - [npm 12: dependency install scripts, git dependencies and remote tarballs are off by default](https://harbyn.com/changes/npm/2026-07-08-npm-12-install-scripts-git-and-remote-dependencies-off-by-default.md) (Breaking change, effective Jul 8, 2026) - [Unvalidated npm trusted publishing configurations now expire](https://harbyn.com/changes/npm/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire.md) (Breaking change, announced Oct 2, 2026) ### Changes at other vendors - [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026) - [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026) - [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026) - [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026) [All upcoming deadlines](https://harbyn.com/deadlines.md)