It just keeps getting worse
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A rant-style opinion piece triggered by the 'mini Shy Halud' npm worm that compromised TanStack and other high-profile packages by hijacking OIDC tokens from GitHub Actions runners to publish malicious versions through legitimate CI/CD pipelines. The author argues that the JavaScript ecosystem's over-reliance on third-party packages is a fundamental design flaw, contrasting it with batteries-included languages like Odin and Go that minimize external dependencies. Key mitigations mentioned include blocking installation scripts by default, using pnpm with minimum release age, and self-hosting package registries. The author also notes the problem extends beyond JavaScript, with Ruby gems and PyPI also affected, and draws a parallel to risks from untrusted AI tool skills/plugins.