Tools
Stage-only npm tokens for safer automation
GitHub added a Read and write (stage only) permission option for npm granular access tokens to stage package versions for review. Automated workflows use the npm stage publish command to submit versions, which package maintainers must approve using two-factor authentication. The opt-in release does not change existing tokens and requires npm CLI 11.15.0 or later and Node.js 22.14.0 or later.