Is this our chance to stop using NPM?
Is this our chance to stop using NPM?
Posted Jun 4, 2026 16:21 UTC (Thu) by cortana (subscriber, #24596)In reply to: Is this our chance to stop using NPM? by mathstuf
Parent article: Multiple redhat-cloud-services npm packages compromised (StepSecurity Blog)
According to this description:
npm binds trusted publishing to a repository plus a workflow filename, not to a branch
... making the repo the unit of trust. I celebrate NPM's bold decision to enforce the concept of Git as a distributed system of repos, rather than the centralized model favoured by enterprises of a single repo with branch protection rules...