{"id":104203,"date":"2022-06-01T09:37:06","date_gmt":"2022-06-01T07:37:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-500-samyh-populyarnyh-paketov"},"modified":"2022-06-01T09:37:06","modified_gmt":"2022-06-01T07:37:06","slug":"v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-500-samyh-populyarnyh-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-vklyuchena-obyazatelnaya-dvuhfaktornaya-autentifikacziya-dlya-500-samyh-populyarnyh-paketov","title":{"rendered":"NPM has implemented mandatory two-factor authentication for the 500 most popular packages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The NPM repository has introduced mandatory two-factor authentication for the accounts maintaining the 500 most popular NPM packages. The popularity criterion used is the number of dependent packages. Maintainers of the listed packages will only be able to perform repository-related operations after enabling two-factor authentication, which requires login confirmation using one-time passwords (TOTP) generated by applications like Authy, Google Authenticator, and FreeOTP, or by hardware keys and biometric scanners that support the WebAuth protocol. <\/p>\n
This is the third phase of strengthening NPM's protection against account compromise. In the first phase, all NPM accounts without two-factor authentication were transitioned to using enhanced account verification, which requires entering a one-time code sent via email when attempting to log in to npmjs.com or performing an authenticated operation in the npm utility. In the second phase, mandatory two-factor authentication was introduced for the 100 most popular packages. <\/p>\n
It is worth noting that according to a study conducted in 2020, only 9.27% of package maintainers used two-factor authentication to secure access, while in 13.37% of cases, developers attempted to reuse compromised passwords found in known data breaches when registering new accounts. During the password reliability check, access was gained to 12% of accounts in NPM (13% of packages) due to the use of predictable and trivial passwords like \"123456\". Among the problematic accounts were 4 user accounts from the Top 20 most popular packages, 13 accounts whose packages were downloaded over 50 million times a month, 40 with over 10 million downloads a month, and 282 with over 1 million downloads a month. Considering the loading of modules via dependency chains, the compromise of unreliable accounts could impact up to 52% of all modules in NPM. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"