Due to increasing attacks on the supply chain and hacks, the administrators of Node Package Manager (npm) decided to force the owners of the hundred most popular (by the number of dependencies) packges to use two-factor authentication.
The new security requirement went into effect on February 1, 2022.The npm developers were forced to take such measures due to increasing security problems. The fact is that malicious libraries often appear due to the fact that the accounts of their developers are hacked: they use too simple passwords, or the same passwords on different sites that leak into the network after third-party companies, sites and services are hacked.
It is worth noting that, according to the WhiteSource Diffend platform, over the past six months alone, more than 1,300 malicious packages have been detected in npm that steal credentials, cryptocurrencies, and so on.
GitHub emphasizes that over time, two-factor authentication will become mandatory for all users. The process that started this week with the owners of the top 100 most popular npm packages will soon continue to spread to the owners of the top 500 libraries. WebAuthn support for accounts will also come in the future.
