Nicholas Zakas, creator and long-time maintainer of ESLint, says GitHub's response to npm's security problems is not enough. He published a detailed breakdown of concrete steps GitHub could take to actually secure npm, and this episode is the extended version of that argument.
The conversation covers why JSR, the most visible npm alternative, does not solve the underlying problem, and why critical JavaScript infrastructure has been allowed to stay in this state for so long. Zakas names specific mechanisms GitHub already controls that could be used differently. That specificity is what makes the original post and this episode worth your time, not just the conclusion.
Read Zakas's blog post at humanwhocodes.com first, then come back for the audio. The gap between what GitHub could do and what it has done is the story.
[READ ORIGINAL →]