Removed: npm token bypass. MFA had always been required for maintainers, but tokens could bypass it; the bypass was removed across all packages.
Outcome: 116 malicious packages published in twenty-five minutes by a token tied to one compromised maintainer account, before the bypass went away.
Publish access is a credential too, and it rarely gets reviewed like logins do. The incident report opens with the count, lists fixes that are all subtractions — “We have always required MFA on NPM for maintainers, but we also allowed (mistakenly) token bypass. Around the same time, we removed token bypass across all packages” — and closes with a commitment to keep “reducing where sensitive credentials exist and are shared”.
The audit advice posted underneath is the one this case asks for: who can publish to your packages, and when did each of them last do it? “If someone hasn’t shipped in 12+ months, their credentials are attack surface accumulating risk without providing value.”
Source: Mastra, incident report (GitHub issue #18061) (17 June 2026)