Post

The secure way to release an npm package in 2026. Andrey Sitnik frames it as raising attackers’ costs: npm Trusted and Staged Publishing, org-wide 2FA, CI actions pinned to SHA, and a 3-day dependency cooldown. #npm #security evilmartians.com/chr...