On September 18, 2026, GitHub announced a new permission for npm granular access tokens: Read and write (stage only). A workflow using one of these tokens can submit a package version with npm stage publish, but it cannot publish that version directly with npm publish. A maintainer must review and approve the staged release using two-factor authentication (2FA). The GitHub changelog entry is dated September 18 and describes the option as available at publication; it does not give a more precise rollout time.
The change gives teams a way to keep automated package preparation without giving the same credential authority to complete a release. It is not, however, a read-only token or a complete defense against a compromised publishing pipeline.
What changes in a release pipeline
Consider a CI job that builds a package after a maintainer merges a change. With a direct-publishing credential, the job can build and release in one uninterrupted path. If an attacker gains control of that job or its token, the same path may let them publish a new version.
A stage-only token changes the last step. The workflow submits a version for review; a maintainer then approves its release with 2FA. According to GitHub’s announcement, npm rejects a direct npm publish attempt made with that token, even if the token is configured to bypass 2FA for automation. The distinction is enforced by the token’s publishing permission, not merely by a convention in the CI script.
That creates a useful trust boundary, but only at the point of releasing a new version. A reviewer still needs to assess what the workflow actually staged. In practice, that means checking the proposed version and its package contents against the intended source change, rather than treating the presence of an approval step as proof that the build is safe. The security benefit is an inference from the documented separation of submission and approval; GitHub does not claim that staging detects malicious artifacts.
This is also a workflow choice, not an automatic migration. Existing tokens retain their direct-publishing capabilities, and teams must opt in to the new permission and replace npm publish with npm stage publish in the relevant automation. GitHub explicitly says the release does not alter existing tokens.
The permission has a narrower name than its powers
“Stage only” describes what the token can do with a new package version; it does not mean that every other package write operation is blocked. GitHub says these tokens retain write permissions including the ability to move distribution tags and deprecate versions. That makes the token materially different from a credential that can only submit an immutable release candidate. The warning is part of the release announcement.
The technical implication is important for incident planning. Moving a dist-tag can change which existing version a consumer gets when they install by that tag; deprecating a version can alter the warning consumers see. Those are consequences of the documented permissions, not evidence that an attack has occurred. Teams should therefore protect a stage-only token as a write credential: limit its exposure in jobs, restrict the packages it covers, and remove it promptly if compromised. Human approval of new versions does not neutralize its other write capabilities.
Where it fits—and where it does not
GitHub presents stage-only tokens as a migration path for teams that cannot yet move to trusted publishing. The company says npm is targeting January 2027 to remove direct publishing through tokens configured to bypass 2FA. That is a stated target, not a claim that all token-based publishing will stop on a fixed day. Both the target and the suggested alternative appear in the September 18 changelog.
The choices solve different operational problems. A team able to adopt trusted publishing can investigate that route instead of maintaining a long-lived publishing token. A team that needs token-based automation but wants a human release decision can use staging. A team that needs unattended releases should not mistake stage-only tokens for a drop-in replacement: the required maintainer approval changes release timing and on-call expectations.
There are concrete prerequisites to test before changing CI. GitHub says staged publishing works with existing npm packages and requires publish access to the package, 2FA enabled on the npm account, npm CLI 11.15.0 or later, and Node.js 22.14.0 or later. A workflow pinned to older tooling will need an upgrade as part of the migration. These requirements are specified by GitHub; the announcement does not establish that every team’s existing release tooling or approval process will work unchanged.
A sensible trial is to take one existing package, stage a routine version through its normal build job, and have a maintainer complete the approval. Verify separately that the old direct-publish path no longer works with the replacement token. Then inspect other jobs that can access it: a credential with dist-tag and deprecation powers should not be available to unrelated tests merely because it cannot publish a new version directly.
What remains unproven
The announcement establishes the permission boundary and the stated prerequisites. It does not provide independent measurements of attack reduction, review quality, or the time staging adds to releases. Nor does it show whether a particular organization’s maintainers will reliably spot a compromised build artifact during approval. Those questions require a team to test its own pipeline and review process.
The practical takeaway is narrower—and stronger—than “npm publishing is now safe.” Stage-only tokens remove direct publication of new versions from a token-based automation path while preserving other consequential write permissions. For teams that need that intermediate state, the September 18 change offers a concrete release boundary. Its value depends on protecting the token, inspecting what CI stages, and making the human approval a real review rather than a routine click.