As initially announced on npm’s X channel, npm have invalidated granular access tokens with write access that bypass two-factor authentication.

This action was taken to help prevent supply chain attacks following the pattern of Mini Shai Hulud.

If your automation or CI/CD workflows are failing as a result, please update the stored npm token used by those workflows, then rerun the workflow. If you continue to run into issues or need additional help, please submit a support ticket through npm Support.

We recommend using npm Trusted Publishing to reduce reliance on long-lived access tokens.