🚨 npm Classic Tokens Being Revoked November 19: Complete Migration Guide

What's Happening

npm has disabled the creation of classic tokens and will revoke ALL existing classic tokens on November 19, 2025. This is a mandatory security upgrade affecting millions of developers and automated workflows.

Timeline & Deadlines

Check If You're Affected

1Check npm Access Tokens

Log in to npm and visit your access tokens page:

# Visit: https://www.npmjs.com/settings/YOUR_USERNAME/tokens

# Or use npm CLI to list tokens
npm token list

Look for tokens marked as "Legacy Token" or "Read and Publish" (legacy format).

2Check CI/CD Secrets

Search your repositories for npm token usage:

# Search for NPM_TOKEN in GitHub Actions
grep -r "NPM_TOKEN" .github/workflows/

# Search in package.json scripts
grep -r "NPM_TOKEN" package.json

# Search in .npmrc files
find . -name ".npmrc" -exec grep "authToken" {} \;

3Check Local Configuration

# Check global .npmrc
cat ~/.npmrc

# Check project .npmrc
cat .npmrc

# Look for lines like:
# //registry.npmjs.org/:_authToken=npm_XXXXXXXXXXXX

Migration Options

Granular Access Tokens Setup

1Create a Granular Access Token

1. 1. Go to npm Access Tokens:

   https://www.npmjs.com/settings/YOUR_USERNAME/tokens

2. 2. Click "Generate New Token" → "Granular Access Token"
3. 3. Configure Token Settings:
   • • Token Name: my-package-publish-token
   • • Expiration: Custom (e.g., 1 year) or No expiration
   • • Packages and scopes: Select specific packages
   • • Organizations: Select if applicable
   • • Permissions: Choose "Read and write"

2Add Token to CI/CD Secrets

GitHub Actions:

# Go to: Repository Settings → Secrets and variables → Actions
# Click "New repository secret"
# Name: NPM_TOKEN
# Value: npm_xxxxxxxxxxxxxxxxxxxx (paste your granular token)

GitLab CI:

# Go to: Project Settings → CI/CD → Variables
# Click "Add variable"
# Key: NPM_TOKEN
# Value: npm_xxxxxxxxxxxxxxxxxxxx
# ✓ Mask variable
# ✓ Protect variable (optional)

3Update CI/CD Configuration

Your existing CI/CD workflows should continue working with granular tokens using the same NPM_TOKEN environment variable:

# .github/workflows/publish.yml
name: Publish to npm

on:
  release:
    types: [created]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci
      - run: npm test
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Trusted Publishing (Provenance)

Trusted publishing eliminates tokens entirely by using OpenID Connect (OIDC) to authenticate GitHub Actions directly with npm. This provides cryptographic proof of where your package came from.

1Enable Trusted Publishing on npm

1. 1. Go to your package settings on npm:

   https://www.npmjs.com/package/YOUR_PACKAGE_NAME/access

2. 2. Scroll to "Publishing access" section
3. 3. Click "Add trusted publisher"
4. 4. Configure GitHub Actions connection:
   • • Repository owner: your-github-username
   • • Repository name: your-repo-name
   • • Workflow name: publish.yml (optional - restricts to specific workflow)
   • • Environment: production (optional - restricts to specific environment)

2Update GitHub Actions Workflow

# .github/workflows/publish.yml
name: Publish to npm with Provenance

on:
  release:
    types: [created]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # REQUIRED for provenance
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci
      - run: npm test

      # Publish with provenance - NO TOKEN NEEDED!
      - run: npm publish --provenance --access public
        # NO env: NODE_AUTH_TOKEN needed!
        # GitHub OIDC handles authentication automatically

3Verify Provenance

After publishing with provenance, users can verify your package origin:

# Check if package has provenance
npm view your-package-name dist.integrity

# Audit package provenance
npm audit signatures

Packages with provenance show a verified badge on npm:

CI/CD Configuration Examples

GitLab CI

# .gitlab-ci.yml
publish:
  stage: deploy
  image: node:20
  only:
    - tags
  script:
    - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
    - npm ci
    - npm test
    - npm publish
  variables:
    NPM_TOKEN: $NPM_TOKEN  # Set in GitLab CI/CD Variables

CircleCI

# .circleci/config.yml
version: 2.1

jobs:
  publish:
    docker:
      - image: cimg/node:20.10
    steps:
      - checkout
      - run:
          name: Authenticate with npm
          command: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > .npmrc
      - run: npm ci
      - run: npm test
      - run: npm publish

workflows:
  publish-on-tag:
    jobs:
      - publish:
          filters:
            tags:
              only: /^v.*/
            branches:
              ignore: /.*/

Jenkins Pipeline

// Jenkinsfile
pipeline {
    agent any

    environment {
        NPM_TOKEN = credentials('npm-token-credential-id')
    }

    stages {
        stage('Install') {
            steps {
                sh 'npm ci'
            }
        }

        stage('Test') {
            steps {
                sh 'npm test'
            }
        }

        stage('Publish') {
            when {
                tag "v*"
            }
            steps {
                sh '''
                    echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
                    npm publish
                '''
            }
        }
    }
}

Travis CI

# .travis.yml
language: node_js
node_js:
  - '20'

deploy:
  provider: npm
  email: your-email@example.com
  api_token: $NPM_TOKEN
  on:
    tags: true

before_deploy:
  - npm ci
  - npm test

Azure Pipelines

# azure-pipelines.yml
trigger:
  tags:
    include:
      - v*

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'
    displayName: 'Install Node.js'

  - script: |
      npm ci
      npm test
    displayName: 'Install and Test'

  - script: |
      echo "//registry.npmjs.org/:_authToken=$(NPM_TOKEN)" > .npmrc
      npm publish
    displayName: 'Publish to npm'
    env:
      NPM_TOKEN: $(NPM_TOKEN)

Troubleshooting

# Ensure .npmrc exists with:
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc

# Or set NODE_AUTH_TOKEN environment variable
export NODE_AUTH_TOKEN=$NPM_TOKEN

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # ADD THIS LINE
    steps:
      # ...

# Create tokens with package-specific access
# Token 1: @myorg/package-a (Read and write)
# Token 2: @myorg/package-b (Read and write)

# Or create one org-scoped token with write access to all packages
# Packages and scopes: @myorg/* (All packages)

Quick Reference

Conclusion

The npm classic token deprecation is a mandatory security upgrade that affects the entire JavaScript ecosystem. With just 7 days until the November 19 deadline, immediate action is required.

For most teams using GitHub Actions, trusted publishing with provenance is the recommended path forward. It eliminates token management entirely while providing supply chain security benefits.

Additional Resources

• npm Access Tokens Documentation
• npm Provenance Documentation
• GitHub: Introducing npm Package Provenance
• npm token CLI command reference