On: Security issue related to the NPM registry

[thayne]

> Transparency is key in maintaining the trust of our community.

and yet a security incident where it was possible to publish any npm package without authentication is nine paragraphs down, and isn't alluded to at all in the page or section titles. I'm not sure that's entirely in the best spirit of transparency.

[jabbany → thayne]

At least the details were there. It's not the best organization but they also didn't withhold anything.

[croes → jabbany]

Hide it in the open isn't any better

[emteycz → thayne]

Wasn't it fixed years ago?

[agency → emteycz]

I believe it says the issue the OP is alluding to was reported and fixed on Nov 2 - two weeks ago.