[dec 16th]: Doc Changes for 2FA Publishing and Secure By Default

[shmam]

Overview

This is a PR to update the documentation to reflect the following changes coming to the npm registry

1. The default package setting for all newly created packages will be Require two-factor authentication or a granular access token with bypass 2fa enabled
2. Publishing a package will require the user to have 2fa enabled or use a granular access token with bypass 2fa enabled.

Summary of file changes (thanks to )

Authentication and Publishing Requirements

• Updated all relevant CLI documentation (npm-publish.mdx across v6–v11) to state that publishing packages to npm now requires either 2FA enabled on the account or a granular access token with bypass 2FA enabled, with links to further documentation. This is highlighted in notes at the top of publish command sections. [1] [2] [3] [4] [5] [6]
• Added clarification that in CI/CD workflows, granular access tokens with bypass 2FA are recommended since interactive authentication is not possible. This is noted in the publish command documentation for each CLI version. [1] [2] [3] [4] [5]

Access Control and 2FA Enforcement

• Updated npm-access.mdx documentation for all CLI versions to indicate that all packages now require either 2FA or a granular access token with bypass 2FA enabled by default, and removed references to the option to disable 2FA via the web interface. [1] [2] [3] [4]
• Changed the npm access set mfa command documentation to remove the none option, reflecting that disabling MFA is no longer supported. [1] [2] [3]

Getting Started and Account Setup Documentation

• Added warning notes to account setup guides to inform users that publishing packages requires 2FA or a granular access token with bypass 2FA, and provided links to relevant documentation. [1] [2]
• Updated reference links in getting started documentation to point to granular access token creation and management pages. [1] [2]
• Removed outdated instructions for disabling 2FA for write operations, as this is no longer supported.