3 ms·
Seems like there could be better options than requiring MFA for publishing. Like, maybe publish it to a pending state so CI can automate it then require a human
by hk1337 4y ago
Seems like there could be better options than requiring MFA for publishing. Like, maybe publish it to a pending state so CI can automate it then require a human to login and approve it?
- woodruffw 4y agoYeah, I think a pending state is probably more ideal here. But I could see that being a little bit of a lift. (I'm still not 100% clear on the security advantages of requiring MFA for API tokens that are limited in scope -- assuming that NPM's tokens don't serve as full user credentials, I don't think they should enforce MFA on them.)