September 23, 2025 at 3:13:47 PM UTC

	Since	posts	replies	likes	reposts and quotes	views
Bluesky	May 2023	1,039	8,236	23,127	2,380
Mastodon	Nov 2022	2,399	29,156	55,396	16,820
GitHub	Jul 2010	179	5,777 3,520	33,866	3,317
npm	Jul 2014	139	1,546			75,991,720
YouTube	Dec 2015	30		1,203		32,713
Letterboxd	Mar 2026	55
Blog	Nov 2025	20
Hacker News	Jan 2011	59	575	802
All	Jul 2010	4,807	37,967	114,394	22,517	76,024,433

Really appreciate that GitHub is taking steps to lock down npm publishing workflows: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

9 replies

Jason Garber 7 min later

@zachleat "Expand eligible providers for trusted publishing."
👀
Microsoft's got a financial incentive to lock everyone in to GitHub, but I would welcome trusted publishing capabilities in alternatives like Forgejo/Codeberg/Gitea/etc.
Emelia 👸🏻 1 hr later

@zachleat @janl this sounds like what they were already doing?
1. Zach Leatherman 1 hr later
  
  @thisismissem @janl hm? I think they’re removing support for a few things
  1. Emelia 👸🏻 1 hr later
    
    @zachleat @janl maybe but if memory serves, they were already making those changes slowly.
    I would've expected a pnpm like approved builds setup, including the ability to review the build script to run. Also the ability to mark a specific package scope as requiring trusted publishing or MFA verified tokens, etc.
    1. Zach Leatherman 1 hr later
      
      @thisismissem @janl ah, I wasn’t aware of already in-motion changes!
      1. Emelia 👸🏻 1 hr later
        
        @zachleat @janl I mean they rolled out granular access tokens and MFA years ago
        
        Zach Leatherman 1 hr later
        
        @thisismissem @janl afaict the biggest change (imo) is to deprecate/remove use of non-granular tokens
Torsten Curdt 1 hr later

@zachleat while applaud this - I would applaud even more if they would also cleanup in their own backyard though.
They still force people to use classic PATs like it's 2010.
https://github.com/orgs/community/discussions/38467
https://github.com/github/roadmap/issues/558
Given the age of the PAT discussion I fear it is rather npm pushing for this - not Github.
I guess every improvement is a win - but still.
Cassandrich 21 hr later

@zachleat I'm really not. Putting "supply chain" burdens on ordinary people is exploitative and abusive behavior by capitalists.
What I want to see is npm's "lol here's a million random-provenance micro-deps" model burned to the ground. I'm happy to see it keep being a source of vulns until it's abandoned.