Repository navigation
Update npm #8641
Description
Site name
npm
Site URL
Update reason
The methods of 2FA that it supports have changed.
Additional information
npm appears now to solely support passkey:
https://docs.npmjs.com/configuring-two-factor-authentication
"You can enable two-factor authentication (2FA) on your npm user account to protect against unauthorized access to your account and packages using a security-key."
I noticed that Vaultwarden reports a missing 2FA entry for this login, but I can never silence said warning due to lack of support for OTP.
Issue Eligibility
- The issue I'm creating is not a duplicate of an existing issue.
- The issue I'm creating is not a duplicate of an existing pull request
Activity
hkamran80 commentedon Aug 24, 2026
I can still configure an authenticator app in my npm account. Is it just the documentation that's changed or are you unable to configure it?
pjrobot commentedon Aug 24, 2026
Hi @hkamran80, so originally I had an authenticator app which persisted but once deleted could not be replaced, the option to add authenticator was no longer available. This behaviour would suggest they are supporting existing authenticator app registration, but are phasing them out. This is supported by the current documentation which specifies passkey only.
Here are the menu options available in my 2FA settings following deletion of my old authenticator setup.
hkamran80 commentedon Aug 24, 2026
Got it. Thanks for checking!
I'll make a PR to update the entry.