3 ms·
> A package is marked as a high impact package when they have more than 1 million weekly downloads or have more than 500 dependents.
by arjvik 4y ago
> A package is marked as a high impact package when they have more than 1 million weekly downloads or have more than 500 dependents.
- Grimburger 4y agoFor such a short blog that I actually clicked on, this is embarrassing. Not reading the article is probably on par with not getting past the 2nd sentence. Am intrigued why this is npm only when they already seem to have some of the strictest publishing requirements around, 2fa or one time passwords are mandatory now I thought?
- Macha 4y agoNo, this is the post that 2FA is becoming mandatory on (github-owned) npm for a larger group of packages (previous waves in February and May covered the top-100 and top-500 respectively). It's not a policy for github accounts, but I can understand the confusion given it is posted on the github blog - the npm blog has been merged into it. That's also why the policy is npm only, github don't own other registries to set policy (though I'll note pypi at least is setting a similar policy)