DevOps Paradox
DOP 366: How to Prevent npm Supply Chain Attacks
52:52
#366: You ran npm install this morning. Maybe you ran it a dozen times. Every one of those pulled down a dependency tree you have never read, from a registry that spent years in maintenance mode, and then executed whatever preinstall and postinstall scripts happened to be in there. On your laptop. With your keys sitting on disk.
Trusted publishing, provenance, staged releases - all good, all…