npm starts 2FA enforcement with top-100 package maintainers

npm has begun enforcing two-factor authentication (2FA) for maintainers of the registry's most depended-upon packages. This is the first concrete step in a phased plan first announced in December, which targets packages with more than 1 million weekly downloads or 500 dependents.

The first enforcement cohort consists of maintainers of the top-100 npm packages by number of dependents. Those who haven't yet enabled 2FA will lose web session access and will be required to set up 2FA before making account changes such as updating email addresses or adding maintainers to projects.

Enhanced login verification timeline

The initial enrollment phase for enhanced login verification ran from December 7, 2021 through January 4, 2022. Based on that rollout, npm plans to enroll all accounts in enhanced login verification on March 1, 2022. Before that permanent switch, two brown-out dates are scheduled—February 16 and February 23—during which all accounts will be temporarily opted in for 24 hours. The intent is to surface any issues before the full rollout.

Registry security improvements shipped

npm has also released several features designed to make 2FA adoption and management easier, particularly for organizations:

  • Token naming: Users who rely on automation tokens in CI/CD pipelines can now assign names to those tokens for clearer management.
  • Organization-level 2FA enforcement: Organization owners can now enforce 2FA for all members from the members page. Members without 2FA enabled will be removed once the owner confirms enforcement.
  • 2FA audit tools: Organization members' 2FA status is now visible in the member list, making it easier to assess readiness before enabling enforcement.
  • Better member invitations: New members are no longer automatically placed on the developers team. Invitations now allow choosing the target team upfront.

What's next: WebAuthn and beyond

The next planned investment is WebAuthn support, which would allow maintainers to use hardware security keys and biometric devices for authentication. This would operate alongside existing one-time password (OTP) authentication methods. A working prototype for registering and using security keys has been completed for both the npm website and CLI. Engineering work on production implementation started this week, following the completion of a design refresh for the 2FA enrollment and management flow.