GitHub, which owns the npm JavaScript package manager, enrolls the maintainers of npm's 100 most popular libraries into mandatory two-factor authentication
This is the opening move of a staged campaign. GitHub bought npm in 2020 with its 1.3M+ packages and 75B monthly downloads, then spent late 2021 patching authentication-bypass flaws that could have let attackers publish versions of any package — so the registry's weakest link was clearly account compromise. Enrolling the top-100 maintainers is the highest-leverage slice of that problem: those libraries sit upstream of most of the JavaScript ecosystem.
The move also prefigures what came next in the coverage: within months GitHub announced it would require 2FA for all code contributors by end of 2023, when only ~16.5% of active users had it enabled, and paired enforcement with Sigstore package signing. The top-100 cohort is effectively the pilot group for platform-wide identity requirements.
First-order effects
Maintainers of npm's 100 most popular libraries lose the ability to publish updates unless they enable two-factor authentication — no opt-out for the packages with the widest blast radius.
Second-order effects
The mandate creates the operational template for GitHub's broader requirement that all contributing developers adopt 2FA by end of 2023, converting a voluntary setting into a publish-or-enable gate for millions of accounts.
Third-order effects
If enforced identity plus Sigstore signing becomes the default for package publishing, open-source supply-chain defense shifts from post-hoc takedowns to platform-mandated credentials — making maintainer account hygiene an infrastructure requirement rather than personal choice.
The trend: Package registries are moving from advisory security guidance to enforced credential requirements, with the most-downloaded packages conscripted first.
Whoa, burying the lede here. VAT/tax management was a huge PITA for accepting sponsorships, in Germany at least. Haven't read the docs yet, but I hope this fixes one of the biggest problems with GH sponsors. https://twitter.com/... https://twitter.com/...
@Techmeme @campuscodi 2FA is a scam. If you lose your phone, you're screwed. If you become ‘censored’ from your phone for whatever reason, you're screwed. 2FA is a detriment to your security. Just have good passwords. Dear Big Tech: Stop the mandates!
It is great that GitHub is working on improving sponsorable visibility. A good step. What would be also a great addition is a Sponsor section below this one that will hint you to sponsor the people that are interacting in the issue or PR, giving more visibility to everyone https:…
Good move by github. They started with rolling out mandatory 2FA to all maintainers of top-100 npm packages. On March 1, they plan to enroll all npm accounts in enhanced login verification (=additional protection for all publishers, but not 2fa) https://github.blog/... #infosec
Sponsors was working for me. If your building things on behalf of the community, you should give it a go. Don't *need * the money? Give it to charity... https://twitter.com/...
Eeek! Launch day!!!! Y'all, this team is so good! ❣️👏 You can now add a private repo to your sponsorship tiers to give sponsors access for sponsorware, early access, private Discussions/Issues... Very excited about this! https://twitter.com/...