Posted by tosh 4 days ago
"Hi, XXXX! It looks like you still do not have two-factor authentication (2FA) enabled on your npm account.
To enable 2FA, please follow the instructions found here."
Disclaimer: I don't know enough of npm/nodejs community so I might be completely off the mark here
But, this coming from GitHub, who believe that sliding "v1" tags on random action repos is how one ends up with https://news.ycombinator.com/item?id=43367987
Every dependency is a backdoor, To make them malicious it only take s a small slip up
Any idea what the interference was?
I certainly wouldn't. And I don't see it as pointless theater. It requires deliberate action, and that's what's missing here.
downvotes appreciated but also happy to see one or two urls that would prove me wrong
Second - an example for a javascript heavy npm utilizing tracking heavy / low content site has not much weight in proving me right - my view is an assumption - 2 examples of shitty tracking SEO AI garbage content blubber sites not using npm would substantially question my assumption... I am genuinely interested in the tech those sites would use instead.
How can anyone publish their packages?
This is the second high-profile instance of the technique this week.
Are they actively forcing it? I've received the "Remember to enable 2FA" email notifications from NPM since 2022 I think, but haven't bothered since I'm not longer publishing packages/updates.
Besides, the email conveniently mentions their "automation" tokens as well, which when used for publishing updates, bypasses 2FA fully.
https://old.reddit.com/r/node/comments/xftu7i/comment/iooabn...
Passkeys are effectively and objectively a better security solution than password+2FA. Among other things, they are completely unfishable.
From what I've heard, they're also unbackupable, and tied to the ecosystem used to create them (so if you started with an Apple desktop, you can't later migrate the passkeys to a Windows desktop, you have to go to every single site you've ever used and create new ones).