Post

🚨 this is the new gold standard: trusted publishing _plus_ a maintainer with 2fa. 👉 check it out docs.npmjs.com/staged-publi...

the thing is, this would not have stopped the latest round of attacks. those releases were all authorized by maintainers, they just had maliciously injected code from the cache that the maintainers didn't know about. the gold standard is still @socket.dev's strategy, this does very little imo.

i mean: all maintainers should do this now not: this solves everything