Post
VoidZero
voidzero.dev
did:plc:vqbogjyhzudzajc6bu6mxdni
You can't stop maintainers getting phished. But what you can is stopping bad release reaching your lockfile!
Set a minimum publish age, approve install scripts per version, let pnpm reject trust downgrades.
@43081j.com in "Securing the JavaScript Ecosystem" 🔒️
@viteconf.org, today, 14:00 UTC
2026-10-15T12:45:35.056Z