---
title: "npm API changes, deprecations and deadlines | Harbyn"
description: "npm: 1 upcoming deadline and 9 recorded changes as of 2026-10-25, each with its source."
canonical: "https://harbyn.com/vendors/npm"
last-updated: 2026-10-06
---

# npm: API changes and deadlines

Markdown version of <https://harbyn.com/vendors/npm>.

Developer tools. 1 upcoming deadline, 9 recorded changes. Every entry cites the npm page we read it from.

## What we read

The npm pages and feeds our ingestion visits, politely and on a schedule.

- **Changelog**: <https://github.blog/changelog/label/supply-chain-security/feed/>

## What the scanner looks for

How `harbyn scan` recognises npm in a repository, on your machine. Nothing leaves it.

- **API hosts**: `registry.npmjs.org`

## Upcoming deadlines

| Deadline | Change | Use instead | Details | Source |
| --- | --- | --- | --- | --- |
| Jan 2027 | npm tokens that bypass 2FA will lose direct publishing | - | <https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-lose-direct-publishing.md> | <https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/> |

## Change history

Newest first, by the date npm announced it. This is the archive: past changes are not warnings, and changes we recorded after they took effect are marked as such.

### October 2026

- Oct 2, 2026, Feature: [Staged publishing now supports creating new packages](https://github.blog/changelog/2026-10-02-npm-staged-publishing-now-supports-creating-new-packages)
- Oct 2, 2026, Breaking change: [Unvalidated npm trusted publishing configurations now expire](https://harbyn.com/changes/npm/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire.md)

### September 2026

- Sep 30, 2026, Notice: [Opt-in dist-tag permissions for npm trusted publishing](https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing)
- Sep 18, 2026, Notice: [Stage-only npm tokens for safer automation](https://github.blog/changelog/2026-09-18-stage-only-npm-tokens-for-safer-automation)
- Sep 9, 2026, Notice: [npm extends recovery-code security holds to all accounts](https://github.blog/changelog/2026-09-09-npm-extends-recovery-code-security-holds-to-all-accounts)
- Sep 3, 2026, Notice: [Multiple trusted publishing configurations for npm](https://github.blog/changelog/2026-09-03-multiple-trusted-publishing-configurations-for-npm)

### July 2026

- Jul 8, 2026, Breaking change: [npm tokens that bypass 2FA can no longer manage accounts, packages or organizations](https://harbyn.com/changes/npm/2026-07-08-2fa-bypass-tokens-can-no-longer-manage-accounts-packages-or-orgs.md) (effective Jul 31, 2026; recorded after the fact)
- Jul 8, 2026, Breaking change: [npm 12: dependency install scripts, git dependencies and remote tarballs are off by default](https://harbyn.com/changes/npm/2026-07-08-npm-12-install-scripts-git-and-remote-dependencies-off-by-default.md) (effective Jul 8, 2026; recorded after the fact)