6 ms·
If the hacker has your password, don't they also have the ability to publish a public key used to verify the signed package? It presumably would protect against
by crashedsnow 8y ago
If the hacker has your password, don't they also have the ability to publish a public key used to verify the signed package? It presumably would protect against distribution of a fake package outside of NPM, but if your NPM account is hosed isn't it too late?
- mirashii 8y agoIf 2fa is enforced, having your password doesn't get you anything. Publishing an npm package isn't having a Twitter account, it's one of those things where enforcing 2fa shouldn't even be a usability question.
- Already__Taken 8y agohow does 2fa work with auto publishing CI pipelines?
- kbenson 8y agoNot necessarily. Have NPM store the public key, and require a lot of red tape and time to update it (versioning with delays). Require multiple keys to sign or vouch for a package before publishing is complete (log of reverse dependencies +1 maybe). There are lots of options.