> ● Automatically expire login tokens

I don't see how this helps the issue at hand; a worm could spread very quickly, requiring just a single publish from each freshly infected user.

> ● Require 2 factor auth for publish operations

This seems very reasonable, and the easiest to implement. It also has the nice effect of being a captcha to the publish operation, which gives it some of the gravitas it deserves in an open ecosystem like npm.

> ● Help users be logged out during install operations

This may break far more packages than might be considered acceptable.

> ● pre-install/post-install scripts should require user to accept or refuse.

Presumably this would be unnecessary with 2FA for each publish operation.

> ● make shrinkwrap by default (and fix all the issues with it) so that running npm install doesn't use different versions when used over time.

Doesn't do much to address the issue at hand. A static dependency tree doesn't mean benevolent dependencies.

> ● make updating a version an explicit decision via npm upgrade

Same issues as shrinkwrap.

Unfortunately this wouldn't fix the issue. A malicious package could simply require() a JS script that does the same thing upon its first require(). There's no dependency on postinstall hooks for this worm to spread. Presumably, if you're installing packages, you intend to run them.