As the creator and long-time maintainer of ESLint, Nicholas Zakas is well-positioned to criticize GitHub’s recent response to npm’s insecurity. He found the response insufficient, and has other ideas on how GitHub could secure npm better. On this episode, Nicholas details these ideas, paints a bleak picture of npm alternatives like JSR, and shares our frustration that such a critical piece of internet infrastructure feels neglected.
<a href="https://changelog.zulipchat.com/#narrow/stream/456187-interviews">Join the discussion</a><a href="https://changelog.com/++" rel="payment">Changelog++</a> members save 6 minutes on this episode because they made the ads disappear. Join today!Sponsors:<ul><li><a href="https://namespace.so">Namespace</a> – Speed up your development and testing workflows using your existing tools. (Much) faster GitHub actions, Docker builds, and more. At an unbeatable price.
</li>
<li><a href="https://www.tigerdata.com">Tiger Data</a> – Postgres for Developers, devices, and agents The data platform trusted by hundreds of thousands from IoT to Web3 to AI and more.
</li>
<li><a href="https://www.squarespace.com/changelog">Squarespace</a> – A website makes it real! Use code CHANGELOG to save 10% on your first website purchase.
</li>
</ul>Featuring:<ul><li>Nicholas C. Zakas &ndash; <a href="https://humanwhocodes.com/" rel="external ugc">Website</a>, <a href="https://github.com/nzakas" rel="external ugc">GitHub</a>, <a href="https://www.linkedin.com/in/nzakas" rel="external ugc">LinkedIn</a>, <a href="https://bsky.app/profile/humanwhocodes.com" rel="external ugc">Bluesky</a>, <a href="https://fosstodon.org/@nzakas" rel="external ugc">Mastodon</a>, <a href="https://x.com/slicknet" rel="external ugc">X</a></li><li>Adam Stacoviak &ndash; <a href="https://adamstacoviak.com/" rel="external ugc">Website</a>, <a href="https://github.com/adamstac" rel="external ugc">GitHub</a>, <a href="https://www.linkedin.com/in/adamstacoviak" rel="external ugc">LinkedIn</a>, <a href="https://changelog.social/@adam" rel="external ugc">Mastodon</a>, <a href="https://x.com/adamstac" rel="external ugc">X</a></li><li>Jerod Santo &ndash; <a href="https://jerodsanto.net" rel="external ugc">Website</a>, <a href="https://github.com/jerodsanto" rel="external ugc">GitHub</a>, <a href="https://www.linkedin.com/in/jerodsanto" rel="external ugc">LinkedIn</a>, <a href="https://changelog.social/@jerod" rel="external ugc">Mastodon</a>, <a href="https://x.com/jerodsanto" rel="external ugc">X</a></li></ul>Show Notes:<ul>
<li><a href="https://humanwhocodes.com/blog/2026/01/how-github-could-secure-npm/">How GitHub could secure npm</a></li>
<li><a href="https://jsr.io/">JSR: the javascript registry</a></li>
<li><a href="https://www.vlt.sh/">vlt /vōlt/</a></li>
</ul>
Something missing or broken? <a href="https://github.com/thechangelog/show-notes/blob/master/podcast/the-changelog-674.md">PRs welcome!</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

Securing npm is table stakes (Interview)

The Changelog: Software Development, Open Source (via Backfeed)

AI Chapters

AI Insights

Reviews