After 500-plus poisoned packages hit the world’s biggest code registry, a new 2FA gate became the first opt-in human checkpoint in npm’s nearly seventeen-year history
Every second, a line of code lands in a staging queue somewhere on the planet. A maintainer types a command. A tarball…