he/him 
Wow, @timer150 built a bot that creates a canary package for each PR to Create React App! Check it out: https://github.com/facebookincubator/create-react-app/pull/3124#issuecomment-329472767 …pic.twitter.com/x6d28Jv1KR
How is this secure? i can just PR something that adds malicious code and own the server the bot is running on.
-
-
Yea, we should do this by mention rather than automatically
It doesn’t have access to the real thing though, just the bot. -
The bot npm account has access to react-scripts-canary too.
- 4 more replies
New conversation -
-
-
It's not like the rest of the npm ecosystem is any more resilient to bad actors; `left-pad` was a great example of how brittle everything is
- 2 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.