Regards 2FA/Login: Except that Microsoft has not done this with GitHub. And NPM is joining GitHub not Microsoft. You will see non login vanishing in favor of GitHub Login for sure. And the second factor, see what GitHub offers. For me that is currently a OTP generator

Gihub already had a masssive social graph. They know who you are in terms of who you work for and who your CTO is. Npm does not know that about me. It has no sales channel.

GitHub is owned by the same entity that owns LinkedIn. Microsoft has really no problems cross linking persons. They can also easily link the source code between the systems etc (if they want).

And they will, to the extent possible by law.

And they will ask you, under the guise of 2fa, to confirm thier suspicions.

And $7 a month gets plently of new upgrade options offered.

All talk of mirrors gets brushed under the carpet.

Microsoft pwn all nodejs code except core and those savvy enough to spot this coming and distribute via debian repos.

I hope they dont use that Microsoft Authenticator app. That has never worked for me, never once got me logged in, and has locked me out of Teams on a couple occasions.

To my understanding you can use any app supporting the common standard there.