Your NPM_TOKEN stops publishing in January 2027. Here's the one-command migration
If your GitHub Actions release publishes to npm with a NPM_TOKEN secret, it has an expiry date. From January 2027, a granular token that bypasses 2FA can no longer publish on its own (npm docs). Since August 2026 you've probably seen this warning in your release logs: npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. The replacement is trusted publishing. GitHub signs a short-lived OIDC token for your workflow run, npm exchanges it for a publish token, and nothing long-lived is stored anywhere.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in