GitHub npm Introduces Stage-Only Tokens for Safer Publishing

GitHub npm rolls out stage-only tokens for controlled automation

GitHub has introduced a new "Read and write (stage only)" permission level for npm granular access tokens, giving development teams a way to automate package staging while maintaining human oversight of what gets published to the npm registry.

The new token type allows automated workflows to use npm stage publish to submit package versions for review, but blocks those same tokens from executing direct npm publish commands. After staging, a package maintainer with two-factor authentication enabled must manually review and approve the release before it reaches the registry.

Stage-only tokens retain other write capabilities including moving distribution tags and deprecating versions, which means teams should treat them with the same security precautions as any other write-enabled token.

Why it matters

This release provides a concrete migration path for teams that currently rely on bypass-2FA tokens for automation. With npm planning to eliminate direct publishing through bypass-2FA tokens in January 2027, organizations that haven't yet adopted trusted publishing now have a middle-ground option that preserves automation workflows while enforcing human approval for registry publication. The staged publishing model reduces the blast radius of compromised automation credentials without forcing teams to rebuild their entire CI/CD pipeline.

Migration path ahead of January 2027 deadline

The stage-only token option arrives as an opt-in feature that doesn't affect existing tokens or their current capabilities. GitHub previously announced that npm would remove direct publishing through bypass-2FA tokens by January 2027, and this new token type offers an alternative for teams not yet ready to implement trusted publishing.

To implement stage-only tokens, teams need to create a granular access token with the new permission level, update their workflow to use npm stage publish instead of npm publish, and designate maintainers to review and approve staged versions with 2FA.

Technical requirements

Staged publishing works with existing npm packages without requiring package-level changes. Teams implementing this workflow need publish access to their packages, 2FA enabled on npm accounts, npm CLI version 11.15.0 or later, and Node.js 22.14.0 or later.

The feature integrates with current npm infrastructure, meaning organizations can adopt it incrementally across their package portfolio rather than requiring a wholesale migration.

These details were first reported by GitHub in their changelog. The company has opened a community discussion category for teams to share questions or identify migration blockers as they prepare for the January 2027 transition deadline.