Tell HN: npm is making 2FA mandatory for accounts with high impact packages

Seems like a good thing overall. I already had 2FA on, so it won't really affect me. They said it won't apply to automation tokens. They define high impact as "packages with more than 1 million weekly downloads or over 500 dependents."