GitHub will require a FIDO-based two-factor authentication method to publish updates to npm packages.
The company will also deprecate legacy long-lived npm tokens and roll out new ones that last only seven days.
Our plan for a more secure npm supply chain
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.
The GitHub Blog (github.blog)
