To reduce these risks, GitHub announced that it would gradually implement the following measures:Require two-factor authentication (2FA) for local publishing. Deprecate classic tokens and TOTP 2FA (migrating to FIDO-based 2FA). Shorten the expiration of publishing tokens. Trusted publishing, already adopted across multiple ecosystems, is strongly encouraged as it eliminates the need to manage API tokens in build systems. NPM maintainers are advised to switch to trusted publishing immediately, as well as to enforce 2FA for publishing and writing, and use WebAuth instead of time-based one-time passwords (TOTP) for 2FA.