NPM Flaws Let Attackers Target Packages for Account Takeover

Team Nautilus discovered and responsibly disclosed two npm information-disclosure flaws that allowed unauthenticated enumeration of maintainers' 2FA status and whether organizations enforced 2FA; using these findings and leaked-password data they measured supply-chain exposure and found substantial risk (32% of top-35 packages and 72% of devDependencies), demonstrating how compromised dependency maintainers could enable account takeovers and downstream malicious package updates.