A tradeoff is often made for automation
npm has top notch security features: CIDR-range restricted tokens, publication notifications, and two-factor authentication, to name a few. Of these, a feature critical to protecting publications is two-factor authentication (2FA).2FA requires that you provide two pieces of information when accessing a protected resource: "something you know" (for instance, a password); and "something you have" (for instance, a code from an authenticator app). With 2FA, if your password is exposed, an attacker still can't publish a malicious package (unless they also steal the "something you have".)
On my team, a small number of developers manage over 75 Node.js libraries. We see automation as key to making this possible: we've written tools that automate releases, validate license headers, ensure contributors have signed CLAs; we adhere to the philosophy, automate all the things!
It's difficult to automate the step of entering a code off a cellphone. As a result, folks often opt to turn off 2FA in their automation.
What if you could have both automation and the added security of 2FA? This is why we built the Wombat Dressing Room.
A different approach to authentication
With Wombat Dressing Room, rather than an individual configuring two factor authentication in an authenticator app, 2FA is managed by a shared proxy server. Publications are then directed at the Wombat Dressing Room proxy, which provides the following security features:Per-package publication tokens.
Wombat Dressing Room can generate authentication tokens tied to repositories on GitHub. These tokens are tied to a single GitHub repository, which the user generating the token must have push permissions for.If a per-package publication token is leaked, an attacker can only hijack the single package that the token is associated with.
Limited lifetime tokens
Wombat Dressing Room can also generate access tokens that have a 24 hour lifespan. In this model, a leaked token is only vulnerable until the 24 hour lifespan is hit.GitHub Releases as 2FA
In this authentication model, a package can only be published to npm if a GitHub release with a corresponding tag is found on GitHub.This introduces a true "second factor", as users must prove they have access to both Wombat Dressing Room and the repository on GitHub.
Getting started with Wombat Dressing Room
We've been using Wombat Dressing Room to manage Google Cloud client libraries for over a year now in our fully automated library release process. As of today, the source is available for everyone on GitHub under an Apache 2.0 license.Wombat Dressing Room runs on Google App Engine, and instructions on getting it up and running can be found in its README.md.
It's my hope that this will help other folks in the community, simplify and automate their release process, while minimizing the attack surface of their libraries.
By Benjamin Coe, works on Node.js client libraries for the Google Cloud Platform, and was the third engineer at npm, Inc.
