# npm extends recovery-code security holds to all accounts

By Steven Van · 2026-09-09

A 72-hour hold on publishing and token creation now follows any npm recovery-code sign-in, not just high-impact accounts.

npm now places a 72-hour security hold on any account after a successful sign-in with a recovery code, a protection that previously applied only to high-impact accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused, though signing in and browsing or installing packages still work. The hold lifts automatically, with no action or support request needed.

The change extends preventive protections [GitHub](<https://creatorstoolbox.com/tools/github>) had built for high-impact npm accounts to all accounts, aiming to slow account-takeover attempts and reduce the risk of malicious publishing from a compromised recovery code. Anyone unexpectedly blocked from publishing who didn't sign in with a recovery code is advised to contact npm Support.

[Read the full announcement](<https://github.blog/changelog/2026-09-09-npm-extends-recovery-code-security-holds-to-all-accounts>).

[![](<https://github.blog/wp-content/uploads/2026/09/649015229-57caf077-e03c-46e7-a150-942c81c774f6.jpg>)](<https://github.blog/changelog/2026-09-09-npm-extends-recovery-code-security-holds-to-all-accounts>)

![GitHub](<https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png>)

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

[View GitHub →](<https://creatorstoolbox.com/tools/github>)

Sources

[Original source](<https://github.blog/changelog/2026-09-09-npm-extends-recovery-code-security-holds-to-all-accounts>)

[Read npm extends recovery-code security holds to all accounts on Creators Toolbox](<https://creatorstoolbox.com/blog/github-npm-extends-recovery-code-security-holds-to-all-accounts>)

---
Canonical source: https://creatorstoolbox.com/blog/github-npm-extends-recovery-code-security-holds-to-all-accounts