# npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks

DevFeed: [npm Token Changes Improve Supply-Chain Security but MFA Phishing and Bypass Tokens Remain Risks](<https://devfeed.tech/articles/npm-s-update-to-harden-their-supply-chain-and-points-to-consider-13191.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/npm-update-to-harden-their-supply-chain-and-points-to-consider>)

Published: 2026-02-03T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-libraries-for-javascript](<https://devfeed.tech/tags/chainguard-libraries-for-javascript.md>), [javascript-packages](<https://devfeed.tech/tags/javascript-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [npm](<https://devfeed.tech/tags/npm.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [secure-packages](<https://devfeed.tech/tags/secure-packages.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>)

## AI overview

The article examines npm's authentication overhaul after the Sha1-Hulud incident. It explains that short-lived session tokens, default MFA for publishing, and OIDC Trusted Publishing improve security, but MFA phishing and optional 90-day tokens with MFA bypass still leave projects vulnerable to supply-chain attacks.

## Source excerpt

npm's token changes help, but MFA phishing and optional bypass tokens still enable supply-chain attacks. Source-built Chainguard Libraries reduce the risk.