A step in the right direction! For most folks: just publish locally (with 2FA) — CI publish is the attack vector typically exploited!

Heads up maintainers of packages, this is a big deal:

github.com/orgs/communi...

— Cassidy (May 19, 2026 at 11:23:20 PM UTC)