SebastianVerified account

There's no legitimate technical reason for Yarn to man-in-the-middle traffic to the npm registry. If it's not spyware, it's at least icky

I believe they used to just have a CNAME that pointed to the npm registry but now it's proxying with an A record. Why?

Even if just for analytics, it's not worth the risk. Now if either npm *or* yarn is hacked, you are compromised.

I'm sure @sebmck has good intentions, but does his reverse proxy have all patches applied? At least npm pays for security audits

I think there's still some confusion around how our proxy actually works. We use Cloudflare which is literally reverse proxy as a service.

Cloudflare are the ones who handle security updates. Being concerned about Cloudflare's security makes sense but odds are you're already...

trusting them. Some of their customers are DigitalOcean, Hacker News, Medium etc. Sites you probably already use.