Enforcing npm publishing access on nodejs packages
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 202
- Forks
- 183
- Avg merge
- 2m
- Merged PRs (30d)
- 1
Description
With granular tokens and OIDC migration in https://github.com/nodejs/admin/issues/998, we could now consider enforcing the rule to require 2fa on publishing, and even disallow tokens (including granular tokens and classic tokens) on packages hosted on https://www.npmjs.com/~nodejs-foundation.
The current available options are (this is a per-package setting):
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked admin issue 998 and reviewing the npm publishing-access options shown in this issue. Determine whether requiring 2FA or disallowing tokens is feasible for the nodejs-foundation packages, and document the agreed policy and implementation path as the definition of done.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100