npm adds stage-only tokens for release automation

npm now offers granular tokens that can stage a package version without directly publishing it.

By twenty8digital · AI-assisted briefingPublished 29 Sept 2026

Conceptual digital network illustration accompanying this technology brief

AI-generated conceptual illustration from the twenty8digital archive. Not a documentary image of this announcement.

Announcement: 18 Sept 2026
Coverage: Global
Primary source: GitHub ↗

What changed?

What should you keep in mind?

A maintainer approves the staged release using two-factor authentication. The token still retains other package write permissions, including changing distribution tags and deprecating versions. Existing tokens are unchanged by this opt-in release. Staged publishing requires an existing package and supported CLI and Node.js versions.

Go to the source

Source announcement: 18 Sept 2026. This is an original summary, not independent on-the-ground reporting.

GitHub ↗

Last updated: 29 Sept 2026. Editorial policy & corrections

npm adds stage-only tokens for release automation

What changed?

What should you keep in mind?

Go to the source

Keep your finger on the pulse.

npm adds opt-in tag management to trusted publishing

GitHub Team gains self-serve Advanced Security trials

GitHub warns of October 7 TLS change for data-residency customers