Post

Did my first talk regarding npm supply chain attacks at an internal developer conference last week. 🎉 My main talking point: Pay attention. It is so easy to mindlessly run an npm install without thinking about possible consequences. 🧵

Especially when you are a new developer you don’t even think about the possible pitfalls. This is why educating people is so important. I added @npmx.dev as an example because it does that in an unobtrusive way.

When looking at a package I am informed about vulns and deprecated packages and can start my own journey of looking into the specifics and seeing if it affects me. It helps me to pay attention!

Sadly it also goes beyond mere facts like these to flag opinionated stuff which hurts the creation of a sustainable and friendly atmosphere within OSS.

The banner shows exactly that. It tells me that I MIGHT not need it. And with that it educates me. It shows me sth I might have missed. And it could help reduce my attack surface by relying on less third party dependencies.

This is specifically spoken from the perspective of a user of open source software and not from a maintainer perspective. But I can also see benefits for the maintainer of a package: reducing the number of users that are not the target audience frees up time and bandwidth for the important issues

And I think the banner also is very open about the source of the information. It directly links to the important parts and gives additional context. It allows you as a reader to take action directly at the source if you choose to do so. So I’m sorry but I fail to see the point your trying to make.