All NPM packages under our purview were manually reviewed to ensure that 2FA was enforced for publishing these packages. Currently, this is being done manually by reviewing each package individually through npmjs.com.
There is currently no way to do an organisation-wide 2FA publishing enforcement nor a way to programmatically retrieve the current packages' 2FA publishing requirement, though there seems to be some future plans.
From https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/:
We are currently working on a variety of enhancements to the registry to make 2FA adoption easier for developers, including:
...
- Better tools for understanding 2FA adoption in npm orgs
However, we can still programmatically enable 2FA for package publishing using libnpmsaccess through a scheduled GitHub Action Workflow. While a "mitigative" solution, it reduces the attack window in case of an accidental disabling of this publishing requirement.
This proposed solution does not:
- Prevent disabling of 2FA publishing requirement
- Provide visibility when a 2FA publishing requirement is disabled
All NPM packages under our purview were manually reviewed to ensure that 2FA was enforced for publishing these packages. Currently, this is being done manually by reviewing each package individually through
npmjs.com.There is currently no way to do an organisation-wide 2FA publishing enforcement nor a way to programmatically retrieve the current packages' 2FA publishing requirement, though there seems to be some future plans.
From https://github.blog/2021-12-07-enrolling-npm-publishers-enhanced-login-verification-two-factor-authentication-enforcement/:
However, we can still programmatically enable 2FA for package publishing using
libnpmsaccessthrough a scheduled GitHub Action Workflow. While a "mitigative" solution, it reduces the attack window in case of an accidental disabling of this publishing requirement.This proposed solution does not: