Post

npm
@npmjs.com

npm Granular Access Tokens that bypass 2FA can no longer manage your account, org, or packages—those actions now require an interactive 2FA challenge, closing a major credential-based attack surface. github.blog/changelog/20...

github.blogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…
npm
@npmjs.com

Coming next: bypass-2FA tokens will also lose direct publish (~Jan 2027). Move automated publishing to trusted publishing (OIDC) or staged publishing.

1 repost3 likes

Ray Gesualdo
@raygesualdo.com

Then please start supporting OIDC on more CI platforms! Bitbucket and Jenkins are both necessary for many companies outside the GitHub ecosystem.