Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Wednesday, 24-Sep-2025 21:40:51 JST Rich Felker

   in reply to

   • Zach Leatherman :11ty:

   @zachleat I'm really not. Putting "supply chain" burdens on ordinary people is exploitative and abusive behavior by capitalists.

   What I want to see is npm's "lol here's a million random-provenance micro-deps" model burned to the ground. I'm happy to see it keep being a source of vulns until it's abandoned.

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Zach Leatherman :11ty: (zachleat@fediverse.zachleat.com)'s status on Wednesday, 24-Sep-2025 21:40:54 JST Zach Leatherman :11ty:

     Really appreciate that GitHub is taking steps to lock down npm publishing workflows: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/