Is this our chance to stop using NPM? [LWN.net]

Is this our chance to stop using NPM?

Posted Jun 2, 2026 20:58 UTC (Tue) by mathstuf (subscriber, #69389)
In reply to: Is this our chance to stop using NPM? by dsommers
Parent article: Multiple redhat-cloud-services npm packages compromised (StepSecurity Blog)

The Red Hat advisory says "a compromised GitHub account". So existing mechanisms:

- 2FA (already possible)
- branch protections (already possible)
- require signed commits (possible?)
- require signed pushes (possible?)

Is this our chance to stop using NPM?

Posted Jun 4, 2026 16:21 UTC (Thu) by cortana (subscriber, #24596) [Link]

According to this description:

npm binds trusted publishing to a repository plus a workflow filename, not to a branch

... making the repo the unit of trust. I celebrate NPM's bold decision to enforce the concept of Git as a distributed system of repos, rather than the centralized model favoured by enterprises of a single repo with branch protection rules...