Why it mattersA CI pipeline that used to publish npm packages with a bypass-2FA token now needs either trusted publishing or the new stage-only token, and a person to promote each stage into a release before January 2027.
GitHub added a new granular npm access token permission on 18 September: Read and write (stage only). Picking it lets an automated workflow submit a package version with npm stage publish, and only that. GitHub says npm rejects direct npm publish attempts with the same token, even if the token is configured to bypass two-factor authentication.
What is different from a normal automation token
A stage-only token still holds the other write permissions on the package: it can move dist-tags and deprecate versions. What it cannot do is release a version to users on its own. Every staged version waits for a person on the package to promote it, so the release step keeps a human in the loop while the build and upload step stays automated.
Requirements to use one are npm CLI 11.15.0 or later, Node.js 22.14.0 or later, two-factor authentication on the npm account, and publish access to the package.
Why this arrived now
npm is targeting January 2027 to remove direct publishing through bypass-2FA tokens. That is the mode most CI pipelines run in today: a machine token in a GitHub Actions secret, with 2FA disabled for that token so publishes do not need a code from a phone. After January 2027, that token can no longer call npm publish at all.
The clean path off it is trusted publishing, where npm accepts a short-lived credential minted by GitHub Actions for the specific workflow, and no long-lived token sits in a secret. Some projects cannot adopt trusted publishing yet, because they publish from an environment npm does not recognise, or because the release job runs outside GitHub Actions. GitHub describes stage-only tokens as "a migration path for token-based automation" for exactly those cases.
The recent supply-chain hits on npm packages, including the Shai-Hulud worm in September and the chalk and debug incidents earlier in the year, all involved a compromised maintainer token being used to push a malicious version directly. A stage-only token turns that specific attack into a staged version somebody still has to accept.
Teams that publish npm packages from CI now have three paths to plan for before the January 2027 deadline: move the release job to GitHub Actions and adopt trusted publishing, keep the current setup and swap the bypass-2FA token for a stage-only token plus a manual promotion step, or accept that publishing from that pipeline stops working and take releases back to a developer's machine. The middle path is the smallest change and the one this feature is built for.
Source
Source: GitHub
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
