npm Blocks 2FA-Bypass Tokens from Account and Package Management Actions

·1 views

As of July 31, npm has restricted granular access tokens (GATs) configured to bypass two-factor authentication from performing account and package management tasks. These tokens can no longer create or delete other tokens, modify maintainer lists, change package access settings, or manage organisation membership without an interactive 2FA challenge. The change is designed to limit the damage from a leaked bypass token, which previously could be used to take over an account entirely. GitHub, which owns npm, recommends teams migrate automated publishing workflows to OIDC-based trusted publishing to eliminate long-lived credentials altogether. The registry has also signalled that bypass-2FA tokens will lose direct publish rights by January 2027, continuing a broader push away from bearer tokens.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Four Free Fixes to Speed Up a Slow WordPress Site for Beginners

Slow-loading WordPress websites are a common problem for beginners, often caused by a few overlooked issues rather than complex technical faults. Uploading uncompressed smartphone photos can force visitors to download tens of megabytes of data per page, significantly increasing load times. Unused themes and redundant plugins also contribute to sluggish performance by adding unnecessary database queries and scripts. Most of these issues can be resolved within twenty minutes without any coding knowledge or paid tools. Cleaning up media files, removing inactive themes, and auditing installed plugins are among the simplest ways to improve site speed and user experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why BusyBox in Alpine Docker Images Deserves More Attention in Production

Alpine Linux, one of the most popular container base images, bundles BusyBox — a single binary that provides dozens of Unix utilities — but it was originally designed for embedded systems, not cloud production environments. Because BusyBox consolidates the entire userspace into one binary, any vulnerability in it exposes all those utilities at once, affecting the base layer of every image built on top of it. Patching such a vulnerability requires rebuilding from a new base image, not just updating application layers. Security best practices recommend pinning Alpine base image versions explicitly and tracking BusyBox CVEs separately from application dependencies. Teams should also evaluate whether production containers genuinely need a shell and utilities, as distroless or scratch images may be safer alternatives for single-process workloads.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Xiaomi's MIUI Disrupts Wireless ADB Debugging and How to Fix It

Xiaomi devices running MIUI frequently experience unstable wireless debugging sessions due to the firmware's aggressive power-saving optimizations, which can throttle or terminate background ADB connections. MIUI's custom ADB implementation may also introduce protocol incompatibilities, particularly after firmware updates that alter how Wi-Fi debugging is handled. Network factors such as signal interference, packet loss, and band-switching between 2.4GHz and 5GHz further compound the instability for developers. While other Android manufacturers can face similar issues, the combination of MIUI-specific optimizations and network variability makes the problem more pronounced on Xiaomi hardware. Developers are advised to disable aggressive power-saving modes or consider third-party tools that work around ADB's limitations on MIUI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust API Design: How the Least-Surprise Principle Shapes Better Interfaces

A technical guide published on DEV Community outlines core principles for designing intuitive Rust APIs, centered on what is called the 'least-surprise' or 'unsurprising' principle. The principle holds that API names and behaviors should closely match conventions already established in the Rust standard library and community, so users can predict functionality without relearning concepts. Key areas of focus include consistent naming conventions, such as methods named 'iter' reliably returning iterators, and proactively implementing standard traits like Debug, Send, Sync, and Unpin. The guide emphasizes that developers should implement common traits even when not immediately needed, since the orphan rule prevents users from adding foreign traits to types they do not own. Practical code examples illustrate how Rust's derive macro simplifies Debug trait implementation and how missing trait bounds surface as compile-time errors.

0 comments Read more at DEV Community