npm Implements 2FA and Install Controls to Combat Supply Chain Attacks
npm, the package manager for JavaScript, has introduced mandatory two-factor authentication (2FA) for publishing packages and new controls for package installations to mitigate supply chain attacks. The changes, announced this week, aim to address growing security concerns in the open-source ecosystem.
Key Details
The new 2FA requirement applies to all package publishers on the npm registry. Developers must now enable 2FA before publishing or updating packages. Additionally, npm has added granular controls for package installations, allowing organizations to restrict which packages can be installed based on predefined policies.
These measures follow several high-profile software supply chain attacks in recent years, where malicious actors compromised legitimate packages to distribute malware. npm’s parent company, GitHub, reportedly identified these security upgrades as critical for maintaining trust in the platform.
Background
Supply chain attacks targeting open-source repositories have increased significantly since 2021. The npm ecosystem, with over 2 million packages, has been particularly vulnerable due to its decentralized nature. Last year, security researchers discovered multiple cases of attackers hijacking abandoned packages or creating malicious lookalikes.
The new installation controls complement existing security features like delegated authentication systems used in other technologies. Organizations can now define rules to block packages from unknown maintainers or restrict installations to vetted sources.
Implementation Timeline
npm will phase in the 2FA requirement over the next three months, starting with high-impact packages. The package installation controls are available immediately for enterprise customers. Free users will gain access to basic filtering options by July 2026.
GitHub’s security team stated these changes represent the first phase of a broader initiative to harden software supply chains against increasingly sophisticated attacks.
