May 12, 2026 at 2:46:07 PM UTC

A versioned archive of posts from Bluesky, Mastodon, GitHub, npm, YouTube, Letterboxd, Hacker News, and blogs. Browse the most popular posts.

Last built Nov 7, 2026, 1:18 PM UTC.

4,807 posts by year

I wonder if the nice folks at @npmx.dev can add a big ol’ warning on packages sourced from repos that use `pull_request_target` 🫣

5 replies

Zach Leatherman 2 min later

(but really GitHub should retire `pull_request_target` or surface some kind of big ol’ warning on it)
Eric Bailey 14 min later

www.youtube.com/watch?v=wfcQ...
1. Zach Leatherman 29 min later
  
  uh oh.
tierney cyren 5 hr later

I’m curious if there’s other similar criteria you’d want to be warned about?
1. Zach Leatherman 5 hr later
  
  I wrote up my checklist here: www.zachleat.com/web/npm-secu... (though I’m sure some of these wouldn’t be publicly accessible information)