There's no excuse to leave critical JS infrastructure this vulnerable to supply chain attacks, thanks to LavaMoat from @metamask.

Hasn't been for a few years, but if it takes a big hack to get you to think longer term, then I recommend you seize the opportunity:

https://github.com/LavaMoat/LavaMoat

@gakonst What do you and Ithaca think of LavaMoat?

cto & general partner @paradigm. ceo /ithaca. working with /rust on /ethereum. building /reth and /foundry. https://gakonst.com

director of product @seedclub. i host S-TIER @ X Spaces & i interview crypto builders @ web3galaxybrain.com.

good idea but everyone should also just set up 2fa on package publishing creds, educate their devs etc