3 ms·
> npm is a package manager for the JavaScript programming language maintained by npm, Inc., a subsidiary of GitHub. -- [1] and Microsoft own Github so Microsof
by theteapot 2y ago
> npm is a package manager for the JavaScript programming language maintained by npm, Inc., a subsidiary of GitHub. -- [1]
and Microsoft own Github so Microsoft is the provider? Pretty sure they're running malware scanners over NPM constantly at the least. NPM also has (optional) provenance [2] to a Github build workflow which is as strong as being "assured" by Google IMO. Only problem is it's optional.
[1]: https://en.wikipedia.org/wiki/Npm https://en.wikipedia.org/wiki/Npm
[2]: https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/ https://github.blog/security/supply-chain-security/introduci...