NPM is moving away from using TOTP 2FA and conventional tokens to enhance security.
After a new wave of phishing attacks on maintainers, incidents involving the compromise of popular packages, and the emergence of worms affecting dependencies, NPM has decided to implement additional security measures: Two-factor authentication will be mandatory for local package publication. The use of one-time passwords (TOTP) for two-factor authentication will be deprecated. Users will transition to the FIDO U2F protocol. The shift to granular tokens, lifespan […]
