npm opens beta for improved 2FA management
Following a wave of account takeovers targeting developers without two-factor authentication (2FA) enabled, npm is now rolling out a public beta of an overhauled 2FA experience. The update applies to all npm accounts and aims to lower the barrier to adoption while adding flexibility for publishers who manage registry access with multiple devices or authentication methods.
Key additions in the beta include:
- Registration of multiple second factors, including security keys, biometric devices, and authenticator apps
- An updated 2FA configuration menu for managing keys and recovery codes
- Full CLI support for login and publish flows using physical security keys and biometric devices
- Self-service viewing and regeneration of recovery codes
The update comes as npm continues its phased enforcement of mandatory 2FA for high-impact maintainers. The top-100 package maintainers were enrolled on February 1. The next cohort—maintainers of the top-500 packages—will be enrolled on May 31. A later enrollment phase will cover maintainers of packages with more than one million weekly downloads or at least 500 dependents.
Before that final cohort is enrolled, npm plans to further polish the WebAuthn login and publishing flow, as well as improve account recovery through stronger identity verification methods.
For implementation guidance, see the npm documentation on configuring 2FA or the general overview of two-factor authentication. Feedback can be filed in the npm feedback repository.
