5 ms·
2FA only protects login. Pretty much all account security from that point on is based on portable bearer tokens.
by forward1 3y ago
2FA only protects login. Pretty much all account security from that point on is based on portable bearer tokens.
- binarymax 3y agoNot sure what you mean. Every time I publish to NPM it prompts me for a one time code.
- mikeryan 3y agoSounds like they’re publishing to npm with a GitHub action which can be done with an automation token which bypasses 2fa
- frankjr 3y agoThere is an option to always require 2fa when publishing a package. > To protect your packages, as a package publisher, you can require everyone who has write access to a package to have two-factor authentication (2FA) enabled. This will require that users provide 2FA credentials in addition to their login token when they publish the package. > Require two-factor authentication and disallow tokens: With this option, a maintainer must have two-factor authentication enabled for their account, and they must publish interactively. Maintainers will be required to enter 2FA credentials when they perform the publish. Automation tokens and granular access tokens cannot be used to publish packages. https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification https://docs.npmjs.com/requiring-2fa-for-package-publishing-...