2 ms·
Probably signatures could alleviate most of these issues, as each publish would require the author to actually sign the artifact, and setup properly with hardwa
by diggan 1y ago
Probably signatures could alleviate most of these issues, as each publish would require the author to actually sign the artifact, and setup properly with hardware keys, this sort of malware couldn't spread. The NPM CI tokens that don't require 2fa kind of makes it less useful though.
Clojars (run by volunteers AFAIK) been doing signatures since forever, not sure why it's so difficult for Microsoft to follow their own yearly proclamation of "security is our top concern".
- madeofpalk 1y agoI would like to see more usage of NPM/Github Actions provenance statements https://www.npmjs.com/package/sigstore#provenance https://www.npmjs.com/package/sigstore#provenance through the ecosystem > The NPM CI tokens that don't require 2fa kind of makes it less useful though Use OIDC to publish packages instead of having tokens around that can be stolen or leaked https://docs.npmjs.com/trusted-publishers https://docs.npmjs.com/trusted-publishers