{"id":102521,"date":"2021-12-08T15:36:53","date_gmt":"2021-12-08T13:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej"},"modified":"2021-12-08T15:36:53","modified_gmt":"2021-12-08T13:36:53","slug":"github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/github-vnedryaet-v-npm-obyazatelnuyu-rasshirennuyu-verifikacziyu-uchyotnyh-zapisej","title":{"rendered":"GitHub implements mandatory enhanced account verification in NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Due to the increasing cases of repository hijacking of large projects and the promotion of malicious code through the compromise of developers' accounts, GitHub is instituting widespread enhanced account verification. Mandatory two-factor authentication will be implemented separately for maintainers and administrators of the 500 most popular NPM packages at the beginning of next year. <\/p>\n
From December 7, 2021, to January 4, 2022, there will be a transition for all maintainers authorized to publish NPM packages but not using two-factor authentication to enhanced account verification. Enhanced verification requires entering a one-time code sent to your email when attempting to log in to npmjs.com or performing an authenticated operation in the npm utility. <\/p>\n
Enhanced verification does not replace but rather complements the previously available optional two-factor authentication, which requires confirmation using one-time passwords (TOTP). When two-factor authentication is enabled, enhanced verification via email is not applied. Starting February 1, 2022, the process of transitioning to mandatory two-factor authentication for the maintainers of the 100 most popular NPM packages with the highest number of dependencies will begin. After migrating the first hundred, the change will be extended to the 500 most popular NPM packages based on the number of dependencies. <\/p>\n
In addition to the currently available two-factor authentication scheme based on applications for generating one-time passwords (Authy, Google Authenticator, FreeOTP, etc.), in April 2022, plans are in place to add support for hardware keys and biometric scanners that support the WebAuthn protocol, as well as the ability to register and manage various additional authentication factors. <\/p>\n
According to a 2020 study, only 9.27% of package maintainers use two-factor authentication to secure access, while in 13.37% of cases, developers attempted to reuse compromised passwords found in known data breaches when registering new accounts. During a password reliability check, access was gained to 12% of accounts in NPM (13% of packages) due to the use of predictable and trivial passwords, such as \"123456.\" Among the problematic accounts were 4 user accounts from the Top 20 most popular packages, 13 accounts for packages that were downloaded more than 50 million times a month, 40 - those with more than 10 million downloads a month, and 282 with over 1 million downloads a month. Given the loading of modules through dependency chains, the compromise of unreliable accounts could affect up to 52% of all modules in NPM. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"