Repository navigation
Enforcing npm publishing access on nodejs packages #1017
Description
With granular tokens and OIDC migration in #998, we could now consider enforcing the rule to require 2fa on publishing, and even disallow tokens (including granular tokens and classic tokens) on packages hosted on https://www.npmjs.com/~nodejs-foundation.
The current available options are (this is a per-package setting):
Activity
ljharb commentedon Oct 22, 2025
Trusted Publishing currently has a number of security issues in its implementation, but once those are resolved, as long as all packages using it are also using Environments with 2+ required reviewers, then this is a great change to make.
legendecas commentedon Oct 22, 2025
This setting is not necessarily associated with OIDC based publishing. This is an enforcement on requiring 2fa when publishing with either classic or granular tokens. This should be a security gain on the current setup.
ljharb commentedon Oct 22, 2025
Right - but I'm saying that migrating from tokens to OIDC should not be an option at the moment, so we can't yet disallow 1FA tokens.
mcollina commentedon Nov 12, 2025
In today TSC meeting we proposed to require publish with 2Fa for all publishing. We didn't have quorum, so, we'd live this open for another week.
@legendecas would post an issue in the packages to notify them of the change.
legendecas commentedon Nov 12, 2025
Packages may be impacted by the change:
(these packages were published in the past year and were published by an individual account or token)