Post

🚨 this is the new gold standard: trusted publishing _plus_ a maintainer with 2fa. 👉 check it out docs.npmjs.com/staged-publi...

Roscoe Rubin-Rottenberg

@knotbin.com

the thing is, this would not have stopped the latest round of attacks. those releases were all authorized by maintainers, they just had maliciously injected code from the cache that the maintainers didn't know about. the gold standard is still @socket.dev's strategy, this does very little imo.

21/5/26, 9:07 pm0 reposts2 likes

daniel r(ooooooh) in nyc 🇺🇸

@danielroe.dev

21 May

i mean: all maintainers should do this now not: this solves everything

Roscoe Rubin-Rottenberg

@knotbin.com

21 May

yeah definitely agree, just frustrated at microsoft's handling (or lack thereof) of this whole moment. it feels like they're putting band-aids on as they're bleeding out