[asylteltine]

When will npm finally take security seriously? How many incidents do they need? Don’t allow non hardware mfa and add verified namespaces already!

[lainga]

Never. It is this way for cosmogonical reasons; it fulfils a purpose. I see Isaac Schlueter as the modern Genghis: "If you had not committed great sins, God would not have sent a punishment like me upon you."

[mikeryan]

It’s not NPMs job to secure your repo. They provide the tools to protect it. It’s your job as a maintainer to not shoot yourself in the foot.