npm extends recovery-code security holds to all accounts
npm has implemented a mandatory 72-hour security hold on all accounts following a successful sign-in via recovery codes. This policy replaces the previous restriction that limited such holds exclusively to high-impact accounts.
Verified State Diff
Impact & Verification Analysis
All npm registry users and package maintainers.
It significantly reduces the window of opportunity for attackers to perform supply chain attacks via compromised accounts, standardizing security posture across the entire npm ecosystem.
Full Fact Overview
The security hold mechanism acts as a circuit breaker for account access, preventing immediate package publishing or sensitive account modifications for 72 hours after a recovery-code authentication event. By expanding this to all npm accounts, GitHub is mitigating the risk of account takeovers where an attacker gains access via stolen recovery codes. This architectural change forces a cooling-off period that allows legitimate account owners time to detect unauthorized access and initiate account recovery or security remediation before malicious code can be injected into the npm registry.