Following a new wave of phishing attacks on maintainers, incidents of popular package compromise, and the emergence of worms affecting dependencies, additional security measures will be implemented in the NPM repository:
- Two-factor authentication will become mandatory for local package publication.
- The use of one-time passwords (TOTP) for two-factor authentication will be deprecated. Users will transition to the FIDO U2F protocol.
- Transition to granular tokens with a lifespan of 7 days. Traditional tokens will be deprecated and access via them will be disabled by default.
- The implementation of the 'Trusted Publishers' mechanism, based on the OpenID Connect (OIDC) standard and short-lived authentication tokens exchanged between external services and the package registry for confirming package publication operations instead of using traditional passwords or permanent API access tokens.
Source: opennet.ru
