npm introduced a new granular token option that grants read/write rights limited to the staging workflow. This change lets automated pipelines place package versions into a review queue without the ability to push them directly to the public registry, which aligns with the upcoming removal of bypass‑2FA publishing.
What Changed in npm Token Model
When generating a token, users can now select Read and write (stage only). The token permits actions required for staging, such as invoking npm stage publish, moving dist‑tags, and deprecating versions, but it blocks any direct npm publish call. Even if the token is configured to bypass two‑factor authentication, npm will reject a direct publish attempt.
Impact on CI/CD and Security Practices
CI/CD jobs that previously used a token capable of publishing now have a narrower privilege set. Staged packages must be approved by a maintainer who authenticates with 2FA before the version can be released. This reduces the blast radius of a compromised automation token and satisfies the security requirement that publishing actions be gated by strong user verification.
Operational Considerations
- Adoption is opt‑in; existing tokens retain their current capabilities.
- Automation scripts must replace the old token with a stage‑only token and switch from
npm publishtonpm stage publish. - Prerequisites include publish access to the target package, 2FA enabled on the npm account, npm CLI 11.15.0 or newer, and Node.js 22.14.0 or newer.
- Stage‑only tokens still allow other write operations (dist‑tag moves, deprecations), so they must be stored and rotated with the same diligence as any write‑level secret.
- npm plans to disable direct publishing via bypass‑2FA tokens by January 2027, making stage‑only tokens a transitional path for teams that cannot yet adopt trusted publishing.
Related CloudNinjas coverage: DevOps.
What This Means For Practitioners
Review your current npm automation tokens and identify any that are used for publishing. Create a stage‑only token for each pipeline, update the workflow to call npm stage publish, and ensure a maintainer with 2FA can approve releases. Monitor npm announcements for the January 2027 deadline and plan to retire bypass‑2FA tokens before that date.