<img src="https://bear-images.sfo2.cdn.digitaloceanspaces.com/crtns/img_7413.webp" alt="headshot" style="max-width: ...
My Github account was blocked from contributing security improvements to the lodash project. This was my first open source work in a while, and unfortunately, it appears it was a waste of time. That said, I did learn a few lessons about contributing to open source projects that others might benefit from. Background I've been going down a rabbit hole to figure out how to improve supply chain…
Motivation I've had it with supply chain attacks. The recent inclusion of malware into the nx package was the last straw for me. Malware being distributed in hijacked packages isn't a new phenomenon, but this was an attack specifically targeting developers. It publicly dumped user secrets to GitHub and exposed private GitHub repos publicly. I would have been a victim of this malware if I had not…