npm installation defaults and staged token restrictions
The news at the time
The npm 12 announcement makes dependency lifecycle scripts and implicit node-gyp builds opt-in, and defaults Git and remote-URL dependency resolution to none unless explicitly allowed. These are installation defaults, not a guarantee that installed code is harmless.
The same notice planned removal of sensitive management actions from npm 2FA-bypass tokens for early 2026-08. It separately targeted direct-publish restrictions for around 2027-01, with trusted publishing or human-approved staged publishing as migration paths.
Follow-up checked during renewal
The 2026-07-31 follow-up says npm 2FA-bypass granular access tokens can no longer perform sensitive management actions and requires an interactive 2FA challenge. It explicitly excludes GitHub personal access tokens, GitHub App tokens and GITHUB_TOKEN from that change.
That follow-up still describes removal of direct publishing as a target for 2027-01. It does not report that later publishing restriction as completed.
What to review before applying this
Test native builds and dependency sources before upgrading, and review script allowlists rather than enabling everything. Verify current publishing support for your CI provider; a schedule announcement is not proof that every registry action has already changed.
Editorial review suggestions; no hands-on product experiment was performed.
Claim-by-claim source evidence
The npm 12 announcement makes dependency lifecycle scripts and implicit node-gyp builds opt-in, and defaults Git and remote-URL dependency resolution to none unless explicitly allowed. These are installation defaults, not a guarantee that installed code is harmless.
Dependency lifecycle scripts (i.e., preinstall , install , postinstall ) and implicit node-gyp builds no longer run unless explicitly allowed.
Evidence source ↗
--allow-git defaults to none
Evidence source ↗
--allow-remote defaults to none
Evidence source ↗
The same notice planned removal of sensitive management actions from npm 2FA-bypass tokens for early 2026-08. It separately targeted direct-publish restrictions for around 2027-01, with trusted publishing or human-approved staged publishing as migration paths.
We expect this change to take effect in early August 2026.
Evidence source ↗
We expect this change to take effect around January 2027.
Evidence source ↗
move automated publishing to trusted publishing (OIDC) or staged publishing with a human approval step
Evidence source ↗
The 2026-07-31 follow-up says npm 2FA-bypass granular access tokens can no longer perform sensitive management actions and requires an interactive 2FA challenge. It explicitly excludes GitHub personal access tokens, GitHub App tokens and GITHUB_TOKEN from that change.
npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions.
Evidence source ↗
This does not affect GitHub personal access tokens, GitHub App tokens, or GITHUB_TOKEN in Actions.
Evidence source ↗
That follow-up still describes removal of direct publishing as a target for 2027-01. It does not report that later publishing restriction as completed.
We are targeting January 2027 for this update.
Evidence source ↗
Korean digest for the historical date: 2026-07-09. Quotations and source context were reviewed editorially; this is not an independent experimental verification.
Discussion