The package manager for JavaScript Problems? Visit npmjs.com/support or github.com/npm/feedback
- Tweets 4,708
- Following 142
- Followers 147,129
- Likes 672
a quick reminder that, on Tuesday, February 1, maintainers of the top-100 packages on the npm registry will be enrolled in mandatory 2FA
2
8
24
we hope to see you at our weekly open rfc meeting today! check out what's on the agenda and how to join ⬇️ github.com/npm/rfcs/issues/5…
2
2
6
we just shipped a number of security-focused improvements to npm including:
- naming access tokens
- enforcing 2FA in your npm orgs
- improved auditing for 2FA adoption in orgs
- selecting teams when adding new org members
read more in our Changelog ⬇️ github.blog/changelog/2022-0…
2
24
53
open rfc meeting is on for today and we've got a full agenda! we'll see you at 11am pt / 2pm et 🕚 github.com/npm/rfcs/issues/5…
1
1
3
npm retweeted
Demo Days is live! Join us to talk complex workflows, managing multiple projects in a single monorepo, securing dependencies and more with the @npmjs CLI.
3
4
6
npm retweeted
In case you missed it, the @npmjs CLI has been making big strides lately. Join us this Friday on Demo Days and we’ll deep dive into Workspaces, Overrides and more!
linkedin.com/feed/update/urn…
1
7
21
continuing our commitment to npm security with the introduction of new enhanced login verification and timeline for two-factor authentication enforcement github.blog/2021-12-07-enrol…
12
40
152
today’s open rfc meeting agenda features running `prepare` scripts for linked bundled dependencies, and more!
come and join the conversation 🎙️ github.com/npm/rfcs/issues/4…
4
2
5
📣 this week's open rfc meeting kicks off in 30 mins. we hope you'll join us! github.com/npm/rfcs/issues/4…
2
2
4
an update on recent security incidents across the registry as well as a look into our ongoing investments in maintaining the security of the registry (including 2FA requirements) ⬇️ github.blog/2021-11-15-githu…
6
63
131
joining us for this week's open rfc? meeting starts at 11am pt / 2pm et 🕰️ github.com/npm/rfcs/issues/4…
4
1
3
following ongoing investigations, we identified in real time multiple versions of the “rc” package containing identical malware to the “coa” package. malicious versions of “rc” were immediately removed from the registry and we have published an advisory: github.com/advisories/GHSA-g…
4
26
44
to protect your accounts and packages from similar attacks, we highly recommend enabling 2FA on your npm account: docs.npmjs.com/configuring-t…. [3/3]
10
6
28
the compromised account has been temporarily disabled and we are actively investigating the incident and monitoring for similar activity. we will share additional information as appropriate based on our investigation. [2/3]
2
4
21
this morning we detected multiple versions of the “coa” package published with malicious code due to a compromised account of a maintainer. we quickly removed the compromised versions and have published an advisory: github.com/advisories/GHSA-7…. npm itself was not compromised. [1/3]
7
109
146