"Join Org" tool fails with 403 due to npm's new bypass-2FA token restrictions

[trungy-bui]

Summary

The @rbxts npm org join tool at https://roblox-ts.com/join-org/ currently
fails for all users with a 403 error. This is caused by a recent npm
policy change restricting granular access tokens configured to bypass
2FA from performing organization-membership actions. Whatever npm token
this tool uses server-side to add users to the org appears to be exactly
that kind of token, and is now blocked by npm itself.

Steps to reproduce

1. Go to https://roblox-ts.com/join-org/
2. Enter a valid npm username (in my case, one with 2FA already enabled)
3. Click Submit

Actual behavior

The page returns "Join Org Failure" with this error:

403 Forbidden - PUT https://registry.npmjs.org/-/org/rbxts/user -
Granular access tokens that bypass two-factor authentication may not
perform this action. For more info, visit:
https://gh.io/npm-gat-bypass2fa-deprecation

Root cause

As of July 31, 2026, npm restricted granular access tokens configured to
bypass 2FA from performing sensitive account/org/package-management
actions — these now require an interactive 2FA challenge instead
(see https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens/).
Adding a user to an npm org falls under that restriction.

This means the backend token this tool uses to call
PUT /-/org/rbxts/user on the npm registry is a bypass-2FA granular
access token, and npm is now rejecting that call outright — regardless
of whether the requesting user (me) has 2FA enabled on their own account.
This isn't something an end user can work around; it needs to be fixed
on the tool's backend.

Environment

• npm username: jeremybui
• 2FA: enabled on my account prior to attempting this
• Date encountered: August 5, 2026