5 ms·

Hi, random developer that somehow ended up in the top 500 but didn't have 2FA turned on (https://www.npmjs.com/package/xlsx https://www.npmjs.com/package/xlsx)!

Hi, random developer that somehow ended up in the top 500 but didn't have 2FA turned on (https://www.npmjs.com/package/xlsx https://www.npmjs.com/package/xlsx)! npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then. Assumably the same fate befalls other random devs.

smoldesu 4y ago
Sounds like a pretty bad policy if that inhibits your ability to respond to critical security flaws in your package.
- _ofdw 4y ago
  The npm ecosystem has been shown over and over again to be a dysfunctional tire fire. I feel like at this point continuing to publish on npm is kind of a "that's what you get" situation.
protomyth 4y ago
Did they tell your users that they locked out the developers? Uhm.... I kinda of expected some mediation or a step-by-step, but that just a dumpster fire solution.
tedmiston 4y ago
> npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then This sucks, but invalidating the pre-2FA tokens is unavoidable if their goal is to tighten security of top packages. I don't know how this went down behind the scenes, but hopefully they announced giving you some long enough window like 60–90 days before the old tokens were invalidated. However, what does invalidating your old tokens have to do with signing into the web app that uses your username and password?
- Arnavion 4y ago
  The real reason seems to be: https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-1110517541 https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-... (archived: https://web.archive.org/web/20220510110516/https://github.com/SheetJS/sheetjs/issues/2667 https://web.archive.org/web/20220510110516/https://github.co... ) >Due to ongoing legal matters between SheetJS LLC and npm, Inc. (which will not be discussed here), it did not make sense to continue using the public npm registry for distribution.
  - jwilk 4y ago
    The real reason for what?
    - norman784 4y ago
      In their comment[0] they said: > npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then. [0] https://news.ycombinator.com/item?id=31575690 https://news.ycombinator.com/item?id=31575690
      - deleted 4y ago
        [deleted]
stefan_ 4y ago
Haha, wow. A classic NPM implementation!
tbeseda 4y ago
I don't know that this is the whole story in your specific case, sheetjs...

smoldesu 4y ago

Sounds like a pretty bad policy if that inhibits your ability to respond to critical security flaws in your package.

_ofdw 4y ago
The npm ecosystem has been shown over and over again to be a dysfunctional tire fire. I feel like at this point continuing to publish on npm is kind of a "that's what you get" situation.

protomyth 4y ago

Did they tell your users that they locked out the developers? Uhm.... I kinda of expected some mediation or a step-by-step, but that just a dumpster fire solution.

tedmiston 4y ago

> npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then This sucks, but invalidating the pre-2FA tokens is unavoidable if their goal is to tighten security of top packages. I don't know how this went down behind the scenes, but hopefully they announced giving you some long enough window like 60–90 days before the old tokens were invalidated. However, what does invalidating your old tokens have to do with signing into the web app that uses your username and password?

Arnavion 4y ago
The real reason seems to be: https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-1110517541 https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-... (archived: https://web.archive.org/web/20220510110516/https://github.com/SheetJS/sheetjs/issues/2667 https://web.archive.org/web/20220510110516/https://github.co... ) >Due to ongoing legal matters between SheetJS LLC and npm, Inc. (which will not be discussed here), it did not make sense to continue using the public npm registry for distribution.
- jwilk 4y ago
  The real reason for what?
  - norman784 4y ago
    In their comment[0] they said: > npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then. [0] https://news.ycombinator.com/item?id=31575690 https://news.ycombinator.com/item?id=31575690
    - deleted 4y ago
      [deleted]

stefan_ 4y ago

Haha, wow. A classic NPM implementation!

tbeseda 4y ago

I don't know that this is the whole story in your specific case, sheetjs...