4 ms·
Not that it’s a bad idea in general, but I don’t think it would help in this situation. I’ve never published NPM packages, but I’m assuming that it only asks fo
by Gaelan 8y ago
Not that it’s a bad idea in general, but I don’t think it would help in this situation. I’ve never published NPM packages, but I’m assuming that it only asks for a 2FA token when you first log in, and not every time you publish. Because this thing is stealing local tokens, I think 2FA wouldn’t help.
- snowwolf 8y agoPossibly not, but it would have prevented the compromise in the first place. My advice was less about helping people affected by this and more about trying to prevent the next one.
- ceejayoz 8y agoMaybe NPM should ask for a 2FA to publish every time?
- paulirwin 8y agoYour assumption appears to be incorrect. If you set up 2FA in "auth-and-writes" mode, it does require a 2FA challenge to publish. Docs: https://docs.npmjs.com/getting-started/using-two-factor-authentication https://docs.npmjs.com/getting-started/using-two-factor-auth...