npm tightens account security and package verification
npm now processes more than 5 billion package downloads per day, and GitHub is using that scale as a reason to push further on registry security. New protections announced today cover the full lifecycle of an npm session: how developers log in and publish, how they prove who they are on their profiles, and how packages are signed and verified.
Browser-based authentication lands in npm 8.15.0
The enhanced two-factor authentication experience that npm first shipped in beta has now reached general availability, with meaningful changes to the command-line flow. The earlier approach prioritized backward compatibility with npm 6 and other clients—Yarn 1 backported support for the new experience in under 10 lines of code—but the interface still had friction worth removing. The npm 8.15.0 update delivers that cleaner CLI experience, which is currently opt-in via the --auth-type=web flag and is scheduled to become the default in npm 9.
Code
npm login --auth-type=web
npm publish --auth-type=web
Under the new model, login and publishing are captured and approved in the browser. Existing sessions can be reused for login, with only a second factor or email verification OTP required to create a new session. For publishers, npm now supports a “remember me for 5 minutes” option that suppresses the 2FA prompt for subsequent publishes on the same IP and access token—a useful behavior for workspaces that push multiple packages in sequence.
Verified GitHub and Twitter identities replace self-reported profile links
Developers have long been able to put GitHub and Twitter handles on their npm profile pages, but those were unvalidated free-form text fields. GitHub is now replacing that legacy data with officially linked accounts via native integrations with GitHub and Twitter. Only verified account data will be displayed on public profiles going forward, allowing visitors to audit whether an npm account is genuinely connected to the identity it claims.
The move is also a foundation for future account recovery: verified cross-platform links let npm automate identity checks during recovery requests. The older, unverified profile fields will continue to be honored for the time being to avoid locking users out, but they are scheduled for eventual deprecation.
ECDSA registry signatures come with a new audit command
Validating that a downloaded package is what the registry says it is used to require a multi-step PGP process that assumed familiarity with cryptographic tooling. npm has replaced those PGP signatures—whose keys are set to expire in early 2023—by re-signing all packages with ECDSA keys managed in an HSM. To make the new scheme usable, the npm CLI now includes an audit signatures command, available in versions 8.13.0 and later.
The registry-wide re-signing effort and the new CLI command give developers a direct way to check package integrity against the registry from their local machines. The command fits naturally into CI pipelines; a sample GitHub Actions workflow demonstrates running the verification on every push.
name: npm Package
on:
release:
types: [created]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: 16.x
registry-url: 'https://registry.npmjs.org'
- run: npm install -g npm
- run: npm ci
- run: npm audit signatures
- run: npm test
- run: npm publish
env:
NODE_AUTH_TOKEN: ${{secrets.npm_token}}
Enforcement ahead for high-impact accounts
GitHub’s next milestone for npm is mandatory 2FA for high-impact accounts—those tied to packages with more than 1 million weekly downloads or at least 500 dependents. That will roughly triple the number of accounts required to enable a second factor. Before the enforcement deadline, npm plans to expand its account recovery options with additional forms of identity verification and more automation in the recovery flow.
