--- title: "npm tokens that bypass 2FA will lose direct publishing: 2027-01 | Harbyn" description: "npm tokens that bypass 2FA will lose direct publishing, effective Jan 2027." canonical: "https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-lose-direct-publishing" last-updated: 2026-09-23 --- # npm tokens that bypass 2FA will lose direct publishing Markdown version of . Breaking change - npm. high severity. Announced. Upcoming. npm is targeting January 2027 (no exact day announced) for removing direct publish from granular access tokens that bypass 2FA. Such tokens will only read private packages and stage a publish, which a maintainer then approves with 2FA. CI pipelines that run npm publish with a long-lived token stop publishing. Move automated publishing to trusted publishing (OIDC) or to staged publishing with a human approval step. About 68 days left: the deadline is Jan 2027 (the vendor named the month, not the day). ## Facts | Fact | Value | | --- | --- | | Vendor | [npm](https://harbyn.com/vendors/npm.md) | | Product | registry | | Kind | Breaking change | | Severity | high | | Status | Announced | | Announced | Jul 8, 2026 | | Effective | Jan 2027 (month only; the vendor gave no day) | | Added to Harbyn | Sep 23, 2026 | | Lead time | 100 days of warning | | Symbols | `NPM_TOKEN`, `NODE_AUTH_TOKEN` | | Replacement | Trusted publishing (OIDC) from CI, or staged publishing approved by a maintainer with 2FA. | | Vendor page | | | Review | Reviewed by a person, extracted by a person | ## Find it in your code ```sh npx harbyn scan ``` This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses npm, from its packages and API hosts. Nothing leaves your machine. ## Sources Where this event comes from: the page we read, when we read it, and the hash of that snapshot. - (changelog, fetched 2026-09-23 22:31 UTC, sha256 `466f09277e0b2ee35943080cfbe756e8f8ccc9ff9ba9ed68db7e0c4fbf8a3f43`) - (changelog, fetched 2026-09-23 22:31 UTC, sha256 `82b9798e49c9cc2561f3a84f1871f6acfd373f66ef9a30f43b370b1addd2fc97`) ## Related changes ### More from npm - [npm tokens that bypass 2FA can no longer manage accounts, packages or organizations](https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-can-no-longer-manage-accounts-packages-or-orgs.md) (Breaking change, effective Jul 31, 2026) - [npm 12: dependency install scripts, git dependencies and remote tarballs are off by default](https://harbyn.com/changes/npm/2026-07-08-npm-12-install-scripts-git-and-remote-dependencies-off-by-default.md) (Breaking change, effective Jul 8, 2026) - [Unvalidated npm trusted publishing configurations now expire](https://harbyn.com/changes/npm/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire.md) (Breaking change, announced Oct 2, 2026) ### Changes at other vendors - [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026) - [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026) - [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026) - [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026) [All upcoming deadlines](https://harbyn.com/deadlines.md)