Every worm and account takeover this summer ended at the same place: a publishing credential. So which registries actually require a second factor from publishers? Andrew Nesbitt's survey, updated on 18 August 2026, goes through them one by one. This post condenses it, with dates as he reports them, so you can see where your own releases are exposed.
The short answer is that it varies a lot, and in several ecosystems the second factor depends on an account the registry does not control.
What each registry requires
| Registry | Position in August 2026 |
|---|---|
| npm | Publishing needs 2FA, or a granular token with a bypass flag. Mandatory enrolment ran in cohorts from 2022 for the most depended-on packages. |
| PyPI | 2FA mandatory for all accounts since 1 January 2024 (TOTP and WebAuthn). |
| RubyGems | Required since August 2022 for owners of gems with more than 180 million total downloads. A per-gem rubygems_mfa_required flag extends it to co-owners. |
| crates.io | No 2FA requirement. Login goes through GitHub OAuth, so protection depends on the GitHub account. |
| NuGet.org | 2FA required on the linked Microsoft identity for new accounts since 8 March 2022. |
| Maven Central | No second factor on the portal login itself. Every artifact must be PGP-signed. |
| Packagist | TOTP available, not mandated. A May 2026 post sets mandatory MFA as the direction. |
| Hex.pm | From 1 November 2026, 2FA applies to all API write operations. |
| Docker Hub, Clojars | TOTP available, not mandated. |
| Hackage, Go proxy, CRAN | No account-based 2FA. |
Recent changes in the survey
- August 2026: npm stopped accepting bypass-2FA tokens for account-governance actions. Removing the bypass for local publishing is proposed but has not landed.
- May 2026: npm staged publishing became generally available, with a human 2FA approval before a staged version is installable.
- July 2026: the crates.io username work started, and Hex announced its Basic auth deprecation.
How to check if you're exposed
For every package you publish, answer four questions and put the answers in a spreadsheet.
- Which registry account owns it, and does that account use a hardware key or an authenticator?
- Does the registry require a second factor, or does it depend on a linked GitHub, Google or Microsoft account?
- Which tokens can publish without a second factor, and where are they stored?
- Which CI jobs publish, and do they use short-lived identity tokens instead of stored secrets?
For npm you can list your tokens with:
npm token list
What to do now
- Turn on a phishing-resistant factor on every registry account, and on the GitHub account behind crates.io, Maven Central and similar sign-ins.
- Replace stored tokens that bypass 2FA with scoped or short-lived credentials, or trusted publishing where the registry supports it.
- For ecosystems with no registry-level 2FA, protect the publishing machine and keep release credentials off developer laptops.
- Subscribe to each registry's announcements. Dates such as Hex's 1 November change affect automation.
How this could have been avoided
Summer 2026 incidents show the pattern. In the ChainDrop wave, the worm republished packages with stolen granular npm tokens that had bypass_2fa set. In the RubyGems legacy key leak, MFA set to ui_and_api would have blocked a leaked key from pushing. In both cases a second factor, or a token that cannot skip it, was the control that mattered.
Quick check
Which registry has required 2FA for all accounts since 1 January 2024?
PyPI.
Why is crates.io protection only as strong as your GitHub account?
crates.io has no 2FA of its own. Logins go through GitHub OAuth.
