3 ms·

NPM/any package manager should not let you upload/manage packages with more than 1k downloads a month without 2FA. It's a liability and this is bound to happen.

• ferdowsi 5y ago
  Does any package ecosystem do this? Rust had the opportunity to start off doing the right thing but instead uses long-lived API tokens which can get easily owned.
  • christophilus 5y ago
    NPM supports TOTP, but it’s opt in.
• koolba 5y ago
  I’ve been saying this for years: https://news.ycombinator.com/item?id=17514541 https://news.ycombinator.com/item?id=17514541 Though rather than mandating it, just show if the publisher has it enabled and let the market decide.
  • thenickdude 5y ago
    Yes, I'd love it if NPM would mark any package as insecure if it transitively depended on a developer that didn't use 2FA.
• eyelidlessness 5y ago
  IMO they—NPM especially—should also prevent publishing arbitrary packages where the source is accessible. In such cases, `npm publish` should be an authorization check and run your publish lifecycle to produce the package. It’s absolutely bonkers that an ecosystem where the vast majority of packages are permissively licensed allows those packages to be published with basically whatever the heck you want, completely independent of whatever you would find inspecting and building it yourself.
• mnahkies 5y ago
  This can be difficult to integrate into CI systems though. I don't recall ever seeing a way to allow interactive input during a CI pipeline to provide a 2FA token. I'd argue that a completely automated release pipeline still trump's a manual/local process with 2fa (for reproducibility and transparency mainly). Being able to have a hold step that also prompts for a token in order to publish in a CI system could be pretty neat though and best of both worlds