Two-factor authentication not widely adopted on npm, the de-facto JavaScript package manager, and the largest package repository on the internet.