npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface.
npm is rotating write-scoped npm Granular Access Tokens that bypass 2FA as a precaution following a now-contained security incident. This doesn't affect GitHub personal access tokens. Maintainers should upgrade the npm CLI to v12+ and consider Trusted Publishing.
Strengthening npm supply-chain security: packages are now scanned for malware at publish time, before they can be installed.
We're also introducing disclosure for legitimate dual-use tools so they aren't blocked by default.
npm v12 is here. npm install now blocks lifecycle scripts, git, and remote-URL dependencies by default — a more secure baseline out of the box.
We're also starting to phase out npm 2FA-bypass tokens for account changes and direct publishing. Details 👇
1/ To prevent supply chain attacks following the pattern of Mini Shai Hulud, we invalidated npm granular access tokens with write access that bypass 2FA. Update the stored token and rerun the workflow for your automations.
