npm Tightens Publisher Account Security With Email OTP and Phased 2FA Enforcement

GitHub has laid out the first concrete phase of its plan to harden the npm registry against account takeover. Starting today, the registry introduces enhanced login verification for all accounts with publishing rights. Maintainers who haven't yet enabled two-factor authentication (2FA) will receive a one-time password (OTP) by email whenever they authenticate through the npmjs.com website or the npm CLI.

That emailed code must be entered alongside the regular password before a session is established. The additional check is aimed squarely at credential-stuffing attacks, which succeed when reused passwords leak from other services. GitHub is explicit that email OTP is a baseline safeguard, not a substitute for stronger factors like time-based one-time passwords (TOTP), WebAuthn, or other methods described in NIST 800-63B. Publishers who already use 2FA will skip the emailed code entirely.

Rollout Schedule for Enhanced Login Verification

The rollout of email OTP will run through the end of the year:

  • December 7, 2021: Rollout begins for all accounts that have ever held publish access to any npm package.
  • January 4, 2022: Rollout completes for all npm publishers.

Detailed instructions are available in the npm documentation on receiving a one-time password over email.

2FA Enforcement Across High-Impact Packages

Beyond the temporary OTP layer, npm is moving toward mandatory 2FA for publishers of widely depended-upon packages. The current registry supports only TOTP via authenticator apps, so GitHub is building out additional capabilities before forcing the issue. Work in progress includes:

  • WebAuthn support for hardware security keys and the biometric scanners built into modern laptops and phones
  • Registration and management of multiple authentication factors per account
  • Better visibility tools for tracking 2FA adoption within npm organizations
  • A more robust account recovery process

Enforcement will proceed in stages rather than hitting every maintainer at once:

  • February 1, 2022: Publishers of the top-100 packages by dependents must have 2FA enabled.
  • Early 2022: The requirement extends to publishers of the top-500 packages by dependents, followed by all publishers of high-impact packages.

The second cohort is deliberately timed to wait for additional 2FA options, with WebAuthn targeted for the registry in April 2022. This gives maintainers more factor choices before the mandate widens, while still allowing the registry team to ship security improvements without stalling the publishing workflow.

GitHub says more detailed timelines and rollups will follow in the new year. In the meantime, maintainers can enroll in 2FA now through the official npm configuration guide.