Tag
4 articles tagged #npm.
P.01The keyv attack poisoned 2,234 package versions in a day, and it won't be the last. The checklist for install scripts, provenance, lockfiles, and CI tokens.
P.02Trusted publishing lets GitHub Actions and GitLab CI publish via short-lived OIDC tokens instead of a stored npm token. The setup, and the May 2026 change.
P.03npm v12 blocks preinstall, install, and postinstall scripts, Git dependencies, and remote tarballs unless allowed. What breaks, and how to migrate.
P.04A 16-package starter set for TypeScript projects: ESLint, Prettier, Vitest, Playwright, MSW, Zod, ky and more, with current versions and the packages to skip.