Securing npm is table stakes (Interview)

确保npm的安全性是基本要求(访谈)

The Changelog: Software Development, Open Source

2026-01-29

1 小时 21 分钟
PDF

单集简介 ...

As the creator and long-time maintainer of ESLint, Nicholas Zakas is well-positioned to criticize GitHub's recent response to npm's insecurity. He found the response insufficient, and has other ideas on how GitHub could secure npm better. On this episode, Nicholas details these ideas, paints a bleak picture of npm alternatives like JSR, and shares our frustration that such a critical piece of internet infrastructure feels neglected.
更多

单集文稿 ...

  • Welcome friends, I'm Jared and you are listening to The Change Log,

  • where each week we interview the hackers, the leaders, and the innovators of the software world.

  • As the creator and longtime maintainer of ESLint,

  • Nicholas Zakis is well positioned to criticize GitHub's recent response to NPMs and security.

  • He found their response insufficient and has other ideas on how GitHub could secure NPM better.

  • On this episode, Nicholas details his ideas, paints a bleak picture of NPM alternatives like JSR,

  • and shares our frustration that such a critical piece of internet infrastructure feels neglected.

  • But first, a big thank you to our partners at fly.io, the platform for devs who just want to ship.

  • Build fast, run any code fearlessly at fly.io.

  • Okay, Nicholas Akis talking NPM on the changelog.

  • Let's do it.

  • This is the year we almost break the database.

  • Let me explain.

  • Where do agents actually store their stuff?

  • They've got vectors, relational data, conversational history, embeddings,

  • and they're hammering the database at speeds that humans just never have done before.

  • And most teams are duct taping together a Postgres instance,

  • a vector database, maybe Elasticsearch for search.

  • It's a mess.

  • Well, our friends at TigerData looked at this and said, what if the database just understood agents?