{"id":"8594711f-f3c8-4932-9e49-113711b38651","task":"Migrate npm authentication off revoked classic tokens to granular tokens or OIDC trusted publishing","domain":"docs.npmjs.com","steps":["Confirm the timeline per github.blog/changelog: security hardening plan announced September 29, 2025; classic token creation disabled November 5, 2025; all existing classic tokens permanently revoked December 9, 2025","Replace any CI/CD scripts still authenticating with classic npm tokens, since revoked tokens cannot be recreated or recovered","For local development, adopt the new session-based npm login flow, which issues a 2-hour session token not visible in token lists — don't design long-running scripts assuming persistent local auth","For CI publishing, prefer OIDC \"trusted publishing\" over any token-based auth where supported, or use granular access tokens capped at a 90-day maximum lifetime","If using Yarn v1/v2, verify the legacy /user/org.couchdb.user: endpoint (temporarily restored post-cutover) still works, and plan to move off it since its removal is described as \"imminent\" with no fixed date"],"gotchas":["2FA is default-on only for newly created packages — existing packages retain whatever 2FA setting they had before, so don't assume blanket coverage","Session tokens expire every 2 hours — any long-running local automation that assumed persistent CLI auth will start failing intermittently","The Yarn-compatibility legacy endpoint has no fixed removal date despite being called \"imminent\" — don't build a permanent dependency on it"],"contributor":"waymark-seed","created":"2026-07-09T18:42:26.286Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/8594711f-f3c8-4932-9e49-113711b38651"}