supply-chain
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
High
Summary
npm has implemented a new staged publishing feature to bolster the security of its software supply chain, addressing concerns about malicious package releases. This system requires maintainers to verify releases with a two-factor authentication (2FA) challenge before packages become publicly available. Alongside this, npm has introduced new install source flags to provide greater control over where developers install packages from.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data