Post

Yarn
@yarnpkg.dev

Reminder that Yarn lets you filter out fresh packages with `npmMinimalAgeGate` and it's a good idea to use it on your work repos!

Yarn
@yarnpkg.dev

Unfortunately it can't help people that happen to create new projects right when the vulnerability is up, since they rarely configure that in their home folder. And making it a default could impair security fixes (for instance the Next.js/React CVEs).

0 reposts1 like

Yarn
@yarnpkg.dev

The right fixes would likely be for the npm registry to *finally* add support for 2FA publishing in a way compatible with both automations and monorepos. They announced some interest couple of months ago, but it hasn't transformed so far.