he/him 
npm inc are complicit in this
https://github.com/eslint/eslint-scope/issues/39#issuecomment-404533026 …
Show this thread
-
Dumb q: how would code signing prevent this? npm would store public keys, so you’d need a valid token and a private key to publish a package? Is then assumption that it’s harder to steal both a token and a private key?
response is not acceptable.
Yep. It doesn’t completely mitigate package hijacking but it increases the barrier.
-
-
I agree that code signing is a good idea for NPM to have, but for other reasons...like someone hijacking a maintainer’s account or pushing something to github. But I don’t think that this issue could’ve been prevented by it.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.