Post

You can't stop maintainers getting phished. But what you can is stopping bad release reaching your lockfile! Set a minimum publish age, approve install scripts per version, let pnpm reject trust downgrades. @43081j.com in "Securing the JavaScript Ecosystem" 🔒️ @viteconf.org, today, 14:00 UTC