Restricting npm bypass-2FA granular access tokens - GitHub Changelog
Try GitHub Copilot CLI
Attend GitHub Universe
Search
Back to changelog
npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry.
This only impacts npm granular access tokens. This does not affect GitHub personal access tokens, GitHub App tokens, or GITHUB_TOKEN in Actions.
What now requires an interactive 2FA challenge
Creating or deleting tokens
Changing package access, maintainers, or trusted publishing configuration
Managing organization/team membership and package grants
An attacker could previously use a leaked 2FA-bypass token to take over an account and mint new tokens, add a maintainer, and more. A token that skips 2FA shouldn’t also be a way to manage your account.
How to prepare
Stop using 2FA-bypass tokens for these operations and perform them interactively (web or CLI) with a 2FA challenge.
Coming next
2FA-bypass tokens will also lose direct publish. Their publishing surface will reduce to reading private packages and staging a publish, which a maintainer approves with 2FA. We are targeting January 2027 for this update. You should move automated publishing to trusted publishing (OIDC) or staged publishing.
This continues the deprecation we announced on July 8. Have questions or a workflow that would be blocked? Tell us in the community discussion.
Related Posts
Jul.28 Release
npm publish-time malware scanning and dual-use metadata
supply chain security
Jul.28 Improvement
Dependabot alerts on malicious packages across more ecosystems
supply chain security
Jul.28 Improvement
GitHub Actions holds potentially malicious workflows for approval
actions<br>supply chain security
...<br>+1
Jul.14 Improvement
Dependabot version updates introduce default package cooldown
supply chain security
Jul.08 Release
Innersource security advisories are generally available
supply chain security
Jul.08 Retired
npm install-time security and GAT bypass2fa deprecation
supply chain security
Jun.30 Release
Open source license compliance is in public preview
supply chain security
Jun.30 Improvement
Dependabot no longer infers .npmrc
supply chain security
Jun.30 Improvement
Upcoming cloud data retention policy for closed security alerts
application security<br>supply chain security
...<br>+1
Subscribe to our developer newsletter
Discover tips, technical guides, and best practices in our biweekly newsletter just for devs.
Enter your email*
Subscribe
By submitting, I agree to let GitHub and its affiliates use my information for personalized communications, targeted advertising, and campaign effectiveness. See the GitHub Privacy Statement for more details.
Back to top
© 2026 GitHub, Inc.
Terms
Privacy
Manage Cookies
Do not share my personal information
LinkedIn icon
GitHub on LinkedIn
Instagram icon
GitHub on Instagram
YouTube icon
GitHub on YouTube
X icon
GitHub on X
TikTok icon
GitHub on TikTok
Twitch icon
GitHub on Twitch
GitHub icon
GitHub’s organization on GitHub