GitHub has announced the release of package manager NPM 8.15, which is included in the Node.js distribution and is used for distributing modules in JavaScript. It is noted that over 5 billion packages are downloaded daily through NPM.
Key changes:
- A new command 'audit signatures' has been added for conducting local integrity audits of installed packages, which does not require manipulation with PGP utilities. The new verification mechanism is based on using digital signatures with the ECDSA algorithm and utilizing a Hardware Security Module (HSM) for key management. All packages in the NPM repository have already been re-signed with the new scheme.
- An expanded two-factor authentication is now available for general use. A simplified login and publishing process in npm CLI is introduced, which works through the browser. When specifying the option '--auth-type=web', a web interface opened in the browser is used for account authentication. Session parameters are remembered. To establish a session, email confirmation is required via one-time passwords (OTP), and for operations within already established sessions, it is sufficient to confirm the second stage of two-factor authentication. A 'remember me' feature is provided, allowing publishing operations from the same IP and with the same token for 5 minutes without additional two-factor authentication requests.
- The ability to link GitHub and Twitter accounts to NPM has been provided, allowing users to connect to NPM using their GitHub and Twitter accounts.
Future plans mention the inclusion of mandatory two-factor authentication for accounts associated with packages that have more than 1 million downloads per week or have more than 500 dependent packages. Currently, mandatory two-factor authentication is only applied to the 500 most popular packages.
Source: opennet.ru
