Software Supply Chain
npm Stage-Only Tokens Block Direct Publishing, Not Every Write
Stage-only is a publishing restriction, not a read-only token. npm's September 18 option lets automation submit versions for maintainer approval with 2FA while rejecting direct publication. The same token can still move dist-tags and deprecate versions.
Citation-ready: npm stage-only tokens deny direct version publication but retain other package write permissions, so they still need the protection appropriate to a write credential.
Evidence boundary: Official permission announcement. No token created, secret inspected, package published or security guarantee established.
What happened and why it matters
The new token type introduces a review point for versions. Its name should not lead maintainers to overlook other changes the credential can still authorize.
Primary evidence
Primary reference: GitHub September 18 npm token changelog. Kaleido Field checked the event date and the article's attributed facts against this source.
| Source date | September 18, 2026 |
|---|---|
| Checked by Kaleido Field | September 19, 2026, CST |
| Source function | software supply chain -> least privilege and release boundaries |
Existing credentials do not change automatically
The release is opt-in and leaves existing tokens unchanged. GitHub describes January 2027 as the target for removing direct publishing through bypass-2FA tokens, not a completed transition. The staging path requires suitable package access, 2FA, npm CLI 11.15.0 or later and Node.js 22.14.0 or later.
A migration record should identify which workflow changed and which credential was retired. The existence of a new token option says nothing about the credentials already stored in a repository's automation.
Separate a submitted artifact from a released version
A workflow can finish staging successfully while the release still awaits review. Dashboards and notifications should preserve those separate states so a waiting package is not announced as available.
A later verification can connect the reviewed artifact to the published version and distribution tags. This follows the same completion principle as our workflow-policy report: a configured control and its observed effect are different evidence.
Evidence boundary
Official permission announcement. No token created, secret inspected, package published or security guarantee established.
FAQ
Does stage-only mean the token cannot modify package metadata?
No. The changelog explicitly retains writes including dist-tag changes and version deprecation.