Post

1. Never manually enter your GitHub or npm password; use a Passkey instead. 2. Enable npm 2FA for both authorization and publishing. 3. Use trusted publishing and remove all npm CI tokens. 4. Only invite maintainers who follow these security practices.

It was a phishing email that hijacked the 2FA? You are implying that the maintainer did not follow these practices? Also: Trusted publishing wouldn’t have made any difference in this case Provenance would only have helped if one would refuse any non-provenance versions

So I came up with four rules, each adding a tile to the roof of security. There’s no single, universal rule that can block every kind of attack.

Passkeys can protect against phishing emails—users simply cannot grant account authentication under an unofficial domain, unless they manually type in their password.

This is the direction we’re working toward, but that doesn’t mean our current efforts are meaningless. For example, taze already detects provenance downgrades and issues warnings.

That’s why I put Passkeys as the very first rule. If full account ownership is compromised, then everything else becomes meaningless, including tokens, trusted publishing, OTP.

What we would truly need:

What I’m offering is the most basic setup we can put in place right now. I believe there are many more ways we can strengthen security. This isn’t an either-or question.

Of course, this isn’t about blaming anyone. But with the recent string of incidents, I believe maintainers should start taking this more seriously.

Every major maintainer is. And 2FA is even enforced for the most popular packages.