A detailed survey of two-factor authentication policies across package registries, prompted by npm's removal of bypass-2FA tokens for account-governance actions this month as part of GitHub's September 2025 supply-chain security plan. Registries are grouped by identity model: those with native accounts (npm, PyPI, RubyGems, Packagist, Docker Hub, Hex.pm, Clojars, Hackage, CPAN), those delegating identity to a platform (crates.io via GitHub, pub.dev via Google, NuGet via Microsoft, Maven Central via GitHub/Google/native), git-based registries where a forge account substitutes for a publisher account (Homebrew, conda-forge, Spack, nixpkgs, Guix, Julia General, GitHub Actions), and email-gated or account-free registries (CRAN, CocoaPods, Go proxy, Swift Package Index). PyPI is the only registry with 2FA mandatory for all accounts since January 2024; NuGet required it on linked Microsoft accounts earlier, since March 2022. The piece also covers trusted publishing (OIDC-based short-lived tokens replacing long-lived API tokens for CI) and npm's new staged publishing feature, generally available since npm CLI 11.15.0, which inserts a human 2FA approval step between upload and public availability even when CI used OIDC.
Table of contents
Registries with their own accounts #Registries that delegate identity to a platform #Registries that are a git repository #Email-gated and account-free #Publishing from CI #Summary #Questions this post answers
When did PyPI make two-factor authentication mandatory for all accounts?
PyPI made two-factor authentication mandatory for every account starting January 1, 2024, accepting both TOTP and WebAuthn as methods. This followed a run-up phase that included distributing 4,000 hardware security keys to maintainers of top projects in 2022, making PyPI the only major registry with complete 2FA enforcement across its entire user base. Track how registries like PyPI harden publishing against supply-chain attacks by following security updates on daily.dev.
What did npm change about 2FA bypass tokens this month?
npm stopped accepting bypass-2FA tokens for account-governance actions, closing one of the remaining routes that let a reusable credential skip two-factor authentication. This is part of the plan GitHub set out in September 2025 to secure the npm supply chain; a further step proposed removing the bypass for local publishing too, though that has not yet shipped. Stay ahead of npm publishing changes affecting CI tokens and maintainer workflows via daily.dev.
How does npm's staged publishing feature work with CI and 2FA?
Staged publishing, generally available since npm CLI 11.15.0 in May 2026, splits publishing into two steps: any token uploads the tarball to a holding area without a 2FA prompt, then a maintainer must approve it through a separate 2FA challenge before it becomes installable. This approval step applies even when the upload used an OIDC trusted-publishing token, keeping a human check between CI and the public index. Developers wiring CI to npm publishing can weigh trusted publishing versus staged approval flows discussed on daily.dev.