[tedmiston]

> npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then

This sucks, but invalidating the pre-2FA tokens is unavoidable if their goal is to tighten security of top packages. I don't know how this went down behind the scenes, but hopefully they announced giving you some long enough window like 60–90 days before the old tokens were invalidated.

However, what does invalidating your old tokens have to do with signing into the web app that uses your username and password?

[Arnavion]

The real reason seems to be:

https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-... (archived: https://web.archive.org/web/20220510110516/https://github.co... )

>Due to ongoing legal matters between SheetJS LLC and npm, Inc. (which will not be discussed here), it did not make sense to continue using the public npm registry for distribution.

[jwilk]

The real reason for what?

[norman784]

In their comment[0] they said:

> npm inc invalidated all of our authentication tokens in mid April and we have been unable to sign in via the web interface since then.

[0] https://news.ycombinator.com/item?id=31575690