[BUG] NPM Granular Access Token are unable to Bypass two-factor authentication (2FA)

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Currently, I am unable to check the box to disable 2FA on npm tokens. This is causing disruption to our package pipeline process as this option is supposed to be configurable. Is there something I am performing incorrectly?

Expected Behavior

I should be able to configure the token via checkbox to enable/disable 2FA auth for a given granular access token

Steps To Reproduce

1. create a token under your organization.
2. navigate to Access Tokens
3. create a granular access token
4. visit granular access token
5. try to check Bypass two-factor Authentication (2FA). Nothing occurs.

Programmatically checking the box doesn't have an effect. Orgs with read/write have bypass for 2fa enabled with granular access token

same organization

Environment

• npm: 10.9.3
• Node.js: v22.19.0
• OS Name: Linux x86_64 GNU/Linux
• System Model Name:
• npm config:

loglevel = "warn"

; node bin location = /usr/local/bin/node
; node version = v22.19.0
; npm local prefix = /root
; npm version = 10.9.3
; cwd = /root
; HOME = /root

Start by reproducing the organization granular access-token flow described in the issue with npm 10.9.3, then determine whether the checkbox behavior belongs in npm CLI or the npm web and organization settings. Done means the Bypass two-factor Authentication (2FA) option can be enabled or disabled for the token and the resulting token behavior matches that setting.