⚙️ DevOps & Platform Eng

ESLint Creator Nicholas Zakas: GitHub's npm Fixes Are Mere Table Stakes

Nicholas Zakas, ESLint's creator, isn't mincing words: GitHub's npm security moves are 'table stakes,' not solutions. One big attack could shatter JavaScript's package empire.

DevTools Feed Apr 03, 2026 3 min read
Nicholas Zakas on Changelog podcast critiquing npm security flaws

⚡ Key Takeaways

  • GitHub's 'trusted publishing' is bare minimum; lacks pre/post-install scanning, leaving npm vulnerable.
  • npm runs on 5-10 staff for billions of weekly downloads — stark understaffing compared to PyPI or Cargo.
  • Alternatives like JSR flop due to ecosystem size; real fix needs mandatory hooks and verified multi-sig publishing.
Published by

DevTools Feed

Ship faster. Build smarter.

#JavaScript packages #eslint #github-npm #nicholas-zakas #npm-security #supply chain attacks

Worth sharing?

Get the best Developer Tools stories of the week in your inbox — no noise, no spam.

Originally reported by changelog.com

Related Stories

📬

Stay in the loop

The week's most important stories from DevTools Feed, delivered once a week.

No spam. Unsubscribe any time.