Tightening the npm Registry: 2FA requirements and two disclosed incidents

GitHub is laying out its near-term security roadmap for the npm registry, starting with mandatory two-factor authentication (2FA) for maintainers and admins of the most popular packages. The first cohort of top packages will be affected in the first quarter of 2022. The announcement accompanies public disclosure of two separate security incidents that recently affected registry services.

Why account takeovers drove the 2FA push

The decision follows a pattern of account takeover (ATO) attacks against npm maintainers, including the recent compromises of ua-parser-js, coa, and rc. In several of these events, the compromised accounts did not have 2FA enabled. GitHub characterizes high-impact ATOs as relatively infrequent compared with malware published by attackers through their own accounts, but notes ATOs targeted at maintainers can be broad in reach.

The npm team has spent the last several months building automated monitoring and analysis for newly published package versions, aiming to catch malicious code in real time. Response times on recent popular-package takeovers have been as low as 10 minutes, GitHub says, and detection capabilities continue to evolve toward a proactive model. But detection alone does not address the underlying account security problem, which is what the 2FA requirement is meant to solve.

GitHub says it is also evaluating next steps to make strong, user-friendly authentication options such as WebAuthn available to npm developers. The company frames the 2FA rollout as part of a broader industry shift toward zero-trust architecture and stronger identity verification across the software supply chain.

Incident one: Private package names in the public replicate feed

The first disclosed issue stems from routine maintenance on October 26 affecting the public npm replica at replicate.npmjs.com. During database maintenance, records were generated that could expose the names of private packages through the public changes feed.

Private package names in the @owner/package format created before October 20 were exposed between October 21 at 13:12:10Z UTC and October 29 at 15:51:00Z UTC. No other information — including package contents — was accessible. After the issue was discovered, GitHub removed all records containing private package names from the replication database on October 29. That cleanup does not extend to third parties that may have already replicated the data elsewhere. The team has changed how the public replication database is provisioned to prevent private package names from being generated during the maintenance process.

Incident two: An authorization bypass in the publishing pipeline

The second issue was reported through GitHub's security bug bounty program on November 2. The vulnerability allowed an attacker to publish new versions of any npm package from an account without proper authorization. GitHub validated the report and patched the flaw within six hours.

Root cause was an inconsistency between the services that handle registry requests. The authorization service checked user permissions against data in request URL paths, while the service performing the actual registry updates determined the target package from the contents of the uploaded package file. An attacker could exploit that discrepancy by authorizing a request for one package while the publish operation was performed against a different, unauthorized package. The fix aligns both services so they evaluate the same package for authorization and publishing.

GitHub states the vulnerability predates the telemetry window, which extends back to September 2020, but says it has high confidence the flaw was not exploited maliciously during that period. The reporting researchers, Kajetan Grzybowski (DrBrix) and Maciej Piechota (haqpl), were credited for the discovery.

Broader security investments

The 2FA requirement and the two remediation efforts sit alongside other ongoing npm security work, including the registry's participation in the GitHub security bug bounty program and collaboration with the Open Source Security Foundation. GitHub indicates more details on the 2FA rollout and WebAuthn support will follow in the coming weeks.

Developers who want to enable 2FA on their npm accounts can find instructions in the npm documentation, and automation tokens are available for tooling workflows that cannot use interactive authentication.