Post

Kevin Deng
@sxzz.dev

PSA: the safest way to publish an npm package today is staged publish + OIDC + provenance. "But it can't stop every attack." Sure, and seatbelts don't prevent every injury either. We still wear them. Security is layers, not silver bullets.

Kevin Deng
@sxzz.dev

Some say "local + 2FA is safer than CI." I don't buy it. Your daily laptop is browsing, chatting, installing random deps, running who knows what. Every bit of that activity adds exposure. A fresh CI run with OIDC + actions pinned to full-length commit SHAs starts from zero.

0 reposts4 likes

Kevin Deng
@sxzz.dev

Concrete example: a malicious VS Code extension might not steal your token (YubiKey or 1Password keeps it safe). But during local npm publish, it can intercept the request and inject code into your package before it reaches the registry. 2FA proves it's you, not what you shipped.