Post

If I have a list of 200 npm packages, do I have to go through them one by one manually?

So I guess this is helpful because it blocks people from being able to publish from like your local system or untrusted CI/CD. But what happens if your GitHub account is compromised? Like that guy-- recently?

If your GitHub account is compromised than the attacker can publish from your trusted CI/CD.

Yeah, exactly. Doesn't completely eliminate the risk. Do you know if JSR is using the same thing to authenticate? OpenID connect OIDC. However they're doing it, it's really freaking easy.

normal 2FA with local publish is the closest tho :-)

zero trust up in here 🙌 I think we all like the serverless pipelines, though, to make sure that the packages are immutable / consistent.

have it make an artifact, and download and publish that locally