{"id":103184,"date":"2022-02-03T15:36:52","date_gmt":"2022-02-03T13:36:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-100-samyh-populyarnyh-paketov"},"modified":"2022-02-03T15:36:52","modified_gmt":"2022-02-03T13:36:52","slug":"v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-100-samyh-populyarnyh-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-100-samyh-populyarnyh-paketov","title":{"rendered":"Mandatory two-factor authentication has been enabled in NPM for the 100 most popular packages","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has announced the implementation of mandatory two-factor authentication for 100 NPM packages that are included as dependencies in the most packages. The maintainers of these packages will now be able to perform authentication-required operations with the repository only after enabling two-factor authentication, which requires login confirmation through one-time passwords (TOTP) generated by applications such as Authy, Google Authenticator, and FreeOTP. In the near future, in addition to TOTP, they plan to add support for hardware keys and biometric scanners that support the WebAuth protocol. <\/p>\n
As of March 1, all NPM accounts that do not have two-factor authentication enabled will be transitioned to use enhanced account verification, which requires entering a one-time code sent to the email when attempting to log in to npmjs.com or perform authentication-required operations in the npm utility. When two-factor authentication is enabled, email verification will not be applied. On February 16 and 13, there will be a temporary trial run of enhanced verification for all accounts for one day. <\/p>\n
It is worth noting that according to a study conducted in 2020, only 9.27% of package maintainers used two-factor authentication to secure access, while in 13.37% of cases, developers attempted to reuse compromised passwords found in known data breaches when registering new accounts. During the password reliability check, access was gained to 12% of accounts in NPM (13% of packages) due to the use of predictable and trivial passwords like \"123456\". Among the problematic accounts were 4 user accounts from the Top 20 most popular packages, 13 accounts whose packages were downloaded over 50 million times a month, 40 with over 10 million downloads a month, and 282 with over 1 million downloads a month. Considering the loading of modules via dependency chains, the compromise of unreliable accounts could impact up to 52% of all modules in NPM. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"