Here's one security concern - What procedure do you follow when accepting files for inclusion in jsdelivr?

I mean, what's to stop this scenario: 1. attacker uploads a poisoned version (say, with an XSS vulnerability) of a popular library to an official-sounding github repo 2. attacker raises a github issue with you asking you to put it on jsdelivr 3. you assume the attacker is a legitimate contributor or user of the library and add it to jsdelivr 4. other sites start using the poisoned version of the library 5. attacker can now carry out XSS attacks on the sites using the library

I have another security concern about www.jsdelivr.com (which I hope is totally separate from the CDN?) but I'll email that to you.