While I agree with this take it should still be a set value in every current config just to make sure that every person gets the benefit. Even if persons use a version of a package manager that does not set a default (pnpm before v11, current Npm versions etc). Goal: default in pm + set config value

We just released the 4.14 branch! 🎊 Two important security changes: - `enableScripts` now defaults to `false` (can be overridden on a per-package basis) - A new `approvedGitRepositories` setting should be used to tell Yarn which git repos are safe to pack.

One of the strengths of Homebrew, despite it being unpopular, is being willing to break backwards compatibility when necessary. NPM’s unwillingness to do so reflects GitHub’s: both show excessive caution that harm both security and usability.

A lot has happened in the last two minor releases of the npm cli that is important to know for people using it: v11.9 : allow-git flag v11.10: min-release-age 🧵

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

if you like my OSS work, please do consider sponsoring 💙 these sponsorships help a lot and are much of why I'm able to carve out dedicated time for open source. i'd love to be able to do more to help the community