npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
In an effort to strengthen the security of the software supply chain, GitHub has implemented new controls for npm that allow maintainers to specifically authorize a release before the packages are made available for public installation.
The capability, known as staged publishing, is currently widely accessible on npm. Before a package is published to npmjs[.]com, it requires a human maintainer to successfully complete a two-factor authentication (2FA) challenge.
The prebuilt tarball is submitted to a stage queue where a maintainer must specifically approve it before it becomes installable, as opposed to a straight publication that instantly makes a package version available to users, according to GitHub.
According to the Microsoft-owned company, the modification guarantees "proof...