[efilife]

https://docs.npmjs.com/configuring-two-factor-authentication

> Important: Publishing to npm requires either: Two-factor authentication (2FA) enabled on your account, OR A granular access token with bypass 2FA enabled

[staticassertion]

I'm assuming the author must have been grandfathered in to TOTP?