GitHub closed the largest credential-based attack surface on npm today, capping a six-front supply chain security blitz in July

GitHub shuts down npm's largest credential-based attack surface

GitHub has closed what it calls one of the largest credential-based attack surfaces on the npm registry. As of today, npm granular access tokens configured to bypass two-factor authentication can no longer perform sensitive account, organization, or package management actions without an interactive 2FA challenge 1.

An attacker with a leaked token could take over the account, mint fresh tokens, add a maintainer, and alter trusted publishing configuration, all while skipping the second factor meant to stop them 1. npm has long operated without a vetting process for submitted packages, meaning any malicious code pushed through a compromised maintainer account could spread rapidly to downstream projects 2.

What now requires a human with 2FA

The operations that 2FA-bypass tokens can no longer perform include creating or deleting tokens, changing package access and maintainer lists, modifying trusted publishing configuration, and managing organization membership and package grants 1. Each must now go through an interactive session, on the web or via CLI, with a 2FA challenge. GitHub's position is direct: "A token that skips 2FA shouldn't also be a way to manage your account" 1.

The restriction applies only to npm granular access tokens. GitHub personal access tokens, GitHub App tokens, and the GITHUB_TOKEN used in Actions are unaffected 1.

A month-long campaign on the npm attack chain

This is not an isolated fix. The change caps a month in which GitHub shipped six supply chain security changes, each closing a different link in the npm attack chain from the moment a package is published to the moment it lands in a developer's dependencies.

On July 8, GitHub shipped npm v12 with install-time security defaults turned on, disabling lifecycle scripts, git dependencies, and remote URL dependencies unless explicitly allowed. That release also launched the deprecation of 2FA-bypass tokens for sensitive operations 3.

On July 14, Dependabot began waiting at least three days after a new release ships before opening a version update pull request, a default cooldown designed to keep compromised or broken versions from reaching dependencies before the community catches them 4.

On July 28, GitHub released three more supply chain defenses in a single batch. npm now scans every package at publish time before it becomes available for download, blocking detected malware and holding suspicious packages for manual review 5. Dependabot alerts began pulling malware advisories from the OpenSSF malicious-packages repository, expanding coverage to PyPI and other ecosystems beyond npm 6. And GitHub Actions now automatically holds workflow runs it identifies as potentially malicious, requiring a collaborator with write access to approve them before execution. GitHub says recent supply chain attacks have used stolen credentials to push malicious workflows that steal CI/CD secrets 7.

The January 2027 deadline for CTOs

Today's change is the first half of a two-phase plan. The second phase, targeted for January 2027, will require migration planning. At that point, 2FA-bypass tokens will lose the ability to publish packages directly. Their publishing surface will reduce to reading private packages and staging a publish, which a maintainer then approves with 2FA 1.

GitHub is directing teams toward two alternatives: trusted publishing using OpenID Connect (OIDC), which lets CI systems authenticate without storing a long-lived secret, or staged publishing, where a package reaches a staging area and goes live only after a maintainer approves it with 2FA 3.

The direction is unambiguous. npm is moving from a model where one secret can unlock every action toward one where the most dangerous operations require verified human involvement. Every layer of the old attack chain is closing. Leaked tokens can no longer manage accounts. Published packages are scanned before they reach anyone. New releases sit behind a three-day buffer before entering dependency updates. Suspicious workflows are held for review. Teams that start their OIDC migration now will meet the January deadline. Teams still depending on a static publish token six months from now will not.