Post

This is good, but unless it's mandatory, I imagine an awful lot of developers are not going to set it up, meaning that the threat will persist from their packages?

the thing is, this would not have stopped the latest round of attacks. those releases were all authorized by maintainers, they just had maliciously injected code from the cache that the maintainers didn't know about. the gold standard is still @socket.dev's strategy, this does very little imo.

i mean: all maintainers should do this now not: this solves everything