AI-generated editorial illustration; not a documentary photograph.
npm has added a stage-only permission option for granular access tokens, GitHub announced on September 18, 2026. It lets automated workflows submit package versions for review without giving the token permission to publish those versions directly to the registry.
A Maintainer Approves the Release
With the new token, a workflow uses npm stage publish to submit a version. A package maintainer must then review and approve the release using two-factor authentication (2FA). npm says it rejects direct npm publish attempts made with a stage-only token, even when that token is configured to bypass 2FA for automation.
An Opt-In Migration Path
The option does not alter existing tokens or remove their ability to publish directly. GitHub says npm is targeting January 2027 to end direct publishing through tokens that bypass 2FA. For teams that cannot yet move to trusted publishing, stage-only tokens provide a way to retain token-based automation while moving final release approval to a maintainer.
Write Access Still Matters
Stage-only does not mean read-only. These tokens retain other package write permissions, including the ability to move dist-tags and deprecate versions, so they still need protection as write credentials. Staged publishing works with existing npm packages but requires package publish access, 2FA enabled on the maintainer’s npm account, npm CLI 11.15.0 or later, and Node.js 22.14.0 or later.
Source: Stage-only npm tokens for safer automation
SIGNAL TITANS
Leave a Reply