npm v12 is now the latest stable release globally, activating stricter security controls during package installation by default and starting the deprecation of sensitive GATs that bypass two-factor authentication. These changes require teams to update their CI/CD pipelines and token management practices ahead of scheduled enforcement dates in August 2026 and January 2027.
- Install-time security defaults enabled by default in npm v12
- 2FA-bypass tokens lose sensitive management and publishing capabilities
- Automated publishing must move to OIDC or staged publishing with human approval
Infrastructure signal
npm v12 activates install-time security protections which were optional in prior versions, marking a shift in how package dependencies are validated during CI/CD runs. This default enforcement improves overall cloud security posture by ensuring only vetted scripts run automatically, thus reducing risk of malicious code execution during installations.
Alongside this, granular access tokens (GATs) configured to bypass two-factor authentication are being deprecated for sensitive operations including account and organization management. The change reflects a cloud infrastructure trend prioritizing zero-trust and multi-factor authentication enforcement across developer and operational interfaces, raising the bar for secure API access and package publishing.
Developer impact
Developers must review and approve lifecycle scripts using npm’s new allowlist mechanism before upgrading to v12 to maintain smooth install workflows. Continuous integration and automated deployment pipelines need revisiting to handle the default opt-in nature of install-time script execution.
Automation relying on 2FA-bypass GATs for publishing or sensitive npm operations will break when these tokens lose elevated permissions in August 2026 and January 2027. Teams must transition to trusted OAuth-based flows or staged publishing workflows that include human Q/A checkpoints, requiring updates to both token management and deployment orchestration.