4 days ago, npm published a blog about protecting your account with 2FA. I’m a user of Google Authenticator ,  and YubiKey - so it was just perfect timing.
To enable 2FA on your profile, you need to install the beta release of npm client:
$> npm install npm@next -g
and follow the rest of the instruction here: https://docs.npmjs.com/getting-started/using-two-factor-authentication