General Availability of improved 2FA experience in npm

July 26, 2022

Enhanced Two-Factor Authentication (2FA) experience is now Generally Available. Previously, we had announced a set of improvements in our public beta. Further to this we have made the following new changes to streamline the CLI login experience.

As of npm 8.15.0 Login and Publish authentication from CLI can now be managed by the browser with the --auth-type=web flag.
Login can use an existing web session, only prompting for your second factor or email verification OTP to create a new CLI session.
Publish now supports “remember me for 5 minutes” and allows for subsequent publishes from the same IP + access token to avoid the 2FA prompt for a 5-minute period.
You can now use 2FA for re-verification requests while performing high privilege operations on npmjs.com.

Read more about two-factor authentication
from our documentation.

A new npm `audit signatures` command to verify npm package integrity

July 26, 2022

The public npm registry is migrating away from the existing PGP signatures to ECDSA signatures that are more compact and can be verified without extra dependencies in the npm CLI.

Ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, by verifying the registry signatures of downloaded packages using the following npm CLI command:

npm audit signatures

The CLI will error if some packages have missing or invalid signatures. This could indicate that those packages might have been tampered with.

Read more about this feature from our documentation: about registry signatures.

See more See more

Dependency graph adds package metadata for Rust dependencies

July 22, 2022

The dependency graph now shows additional metadata for Rust dependencies, and listed dependencies link back to the GitHub repositories for the package if available.

Learn more about the dependency graph.

See more See more

View all changes

General Availability of improved 2FA experience in npm

A new npm `audit signatures` command to verify npm package integrity

Dependency graph adds package metadata for Rust dependencies

Subscribe to The GitHub Insider