To protect against account takeover attacks aimed at gaining control over dependencies, the RubyGems package repository has announced a shift to mandatory two-factor authentication for accounts maintaining the 100 most popular packages (based on download numbers), as well as packages that have more than 165 million downloads. The use of two-factor authentication will significantly complicate access in the event of a developer's credentials being compromised, for example, due to reusing a password on a compromised site, using predictable passwords, or having credentials intercepted as a result of malware activity on the developer's system.
In the first stage, when using the command line utilities or the rubygems.org website, maintainers of popular packages will receive a warning about the need to enable two-factor authentication. On August 15, this recommendation will become a mandatory requirement for enabling two-factor authentication, without which access will not be provided. One month and one week prior to the mandatory implementation of two-factor authentication, maintainers will also be sent email notifications.
In Q4 2022, there are plans to extend the requirement for two-factor authentication to other categories of RubyGems users (criteria have yet to be established, but similar to NPM, the coverage is likely to be expanded to the 500 most popular packages).
Source: opennet.ru
