The NPM repository has introduced mandatory two-factor authentication for the accounts maintaining the 500 most popular NPM packages. The popularity criterion used is the number of dependent packages. Maintainers of the listed packages will only be able to perform repository-related operations after enabling two-factor authentication, which requires login confirmation using one-time passwords (TOTP) generated by applications like Authy, Google Authenticator, and FreeOTP, or by hardware keys and biometric scanners that support the WebAuth protocol.
This is the third phase of strengthening NPM's protection against account compromise. In the first phase, all NPM accounts without two-factor authentication were transitioned to using enhanced account verification, which requires entering a one-time code sent via email when attempting to log in to npmjs.com or performing an authenticated operation in the npm utility. In the second phase, mandatory two-factor authentication was introduced for the 100 most popular packages.
It is worth noting that according to a study conducted in 2020, only 9.27% of package maintainers used two-factor authentication to secure access, while in 13.37% of cases, developers tried to reuse compromised passwords found in known password leaks when registering new accounts. During a password strength check, access was gained to 12% of accounts on NPM (13% of packages) due to the use of predictable and trivial passwords like '123456'. Among the problematic accounts were 4 users from the Top 20 most popular packages, 13 accounts whose packages were downloaded more than 50 million times a month, 40 with over 10 million downloads a month, and 282 with more than 1 million downloads a month. Considering the loading of modules through dependency chains, the compromise of insecure accounts could potentially affect up to 52% of all modules in NPM.
Source: opennet.ru
