Here: https://passwordless.net/ (It's for Express + NodeJS)

Open source, you can use whatever you want to get the code to the user. It's from Mozilla.

Unfortunately I think the biggest advertised feature is the ability to authenticate users by phone number which this doesn't do.

It does and it's designed for it. Found this example online: https://github.com/rbudiharso/smsauth-example Basically you can use any delivery mechanism with it you'd like

My apologies. This wasn't obvious from the main project page.

At Nexmo we've been powering similar solutions for a lot of apps through our SMS API. However, we've just released a higher-level API that leverages our SMS / Voice APIs to make this kind of number verification easy to implement. Ours includes multiple deliveries and channels (falls back to a voice call if needed). We're looking for early adopters, would love to have you take a look: https://docs.nexmo.com/index.php/verify

Google authenticator?

https://code.google.com/p/google-authenticator/