News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by floydnoel on Tuesday September 16, 2025 @09:14AM (#45261805)
NPM does require 2FA to publish. I would love a workaround! Isn't it funny that even here on HN, misinformation is constantly being spread?
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by cxr on Tuesday September 16, 2025 @09:53AM (#45262306)
NPM does not require two-factor authentication. If two-factor authentication is enabled for your account and you wish to disable it, this explains how to do that if allowed by your organization:

<https://docs.npmjs.com/configuring-two-factor-authentication...>

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by bakkoting on Tuesday September 16, 2025 @01:02PM (#45264888)
It doesn't require 2FA in general, but it does for people with publish rights for popular packages, which covers most or all of the recent security incidents.

https://github.blog/changelog/2022-11-01-high-impact-package...

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by olejorgenb on Tuesday September 16, 2025 @06:15PM (#45268926)
> The malware includes a self-propagation mechanism through the NpmModule.updatePackage function. This function queries the NPM registry API to fetch up to 20 packages owned by the maintainer, then force-publishes patches to these packages.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by yawaramin on Tuesday September 16, 2025 @11:26PM (#45271279)
npm offers 2FA but it doesn't really advertise that it has a phishing-resistant 2FA (security keys, aka passkeys, aka WebAuthn) available and just happily lets you go ahead and use a very phishable OTP if you want. I place much of the blame for publishers getting phished on npm.
[ Parent | on HN ]