Hacker News Reader

Moving forward NPM should require 2-factor authentication for popular packages.

This seems like a good idea. If a package has more than x downloads or y dependencies, then require 2fa for publishing it.

Or for publishing all packages

I cannot think of a reasonable argument against this if security is any priority at all at NPM.