npm’s Update to Harden Their Supply Chain, and Points to Consider

The article analyzes npm’s December 2025 authentication overhaul following the Sha1-Hulud incident, noting improvements like short-lived session tokens, MFA-by-default on publish, and OIDC Trusted Publishing, while warning that optional MFA and 90-day tokens still enable supply-chain abuse via MFA phishing and console compromise; it recommends mandating OIDC, enforcing MFA for local uploads, and adding release metadata, and promotes building from verified upstream source (e.g., Chainguard Libraries) to avoid malicious artifacts.