I wonder what is the long term plan.
Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?
Maybe the next step is to sell the control of all these packages to a rogue entity to be used for a supply chain attack?
A secured registry is long overdue, where every release gets an audit report verifying the code and authorship of a new release. It won't be nearly as fast as regular NPM package development but that's a good thing, this is intended for LTS versions for use in long-term software. It'd be a path to monetization as well, as the entities using a service like this is enterprise softare and both the author(s) of the package as the party doing the audit report would get a share.
Actually no, I just wonder why no one takes seriously these types of risks.
Supply chain attacks are a thing nowadays, but no one really cares, 6 months ago we had the xz attack but basically no one remember about it today.
Microsoft did exactly that (since they own both NPM and Github) by allowing you to verify the provenance of NPM packages built using Github Actions [1]. It's not required for all packages though. They've also started requiring all "high impact" packages to use two factor authentication [2].
[1] https://github.blog/security/supply-chain-security/introduci...
[2] https://github.blog/changelog/2022-11-01-high-impact-package...