GitHub enhances 2FA for npm, improves security and manageability

guest · Jul 29, 2022

New features also include ability to connect social media accounts
July 28, 2022

GitHub has announced three enhancements to JavaScript package manager npm which aim to improve its security and manageability.

A new CLI command has been introduced to verify the integrity of packages in npm, replacing the current, more cumbersome, multi-step PGP process, which is now set to expire early next year.

“Recently, we began work to re-sign all npm packages with new signatures relying on the secure ECDSA algorithm and using an HSM for key management, and you can now rely on this signature to verify the integrity of the packages you install from npm,” writes Myles Borins and Monish Mohan, product managers at GitHub and npm, respectively, in a blog post.
“We have introduced a new audit signatures command in npm CLI version 8.13.0 and above.”
Click to expand...

Also new is the ability to connect GitHub and Twitter accounts to npm. While developers were already able to include their GitHub and Twitter handles, this was until now a free-form text field that wasn’t validated or verified.

Finally, following mixed feedback on the recent announcement of enhancements to make two-factor authentication (2FA) adoption easier for developers, there are new moves to streamline the login and publishing experience, available in npm 8.15.0.
Click to expand...

GitHub: Introducing even more security enhancements to npm

New npm security enhancements include an improved login and publish experience with the npm CLI, connected GitHub and Twitter accounts, and a new CLI command to verify the integrity of packages in npm.
Click to expand...

Log in or Sign up

GitHub enhances 2FA for npm, improves security and manageability

guest Guest

Log in or Sign up

GitHub enhances 2FA for npm, improves security and manageability

guest Guest

Useful Searches