A very pertinent comment from zod's maintainer, from that page:
> EDIT Sept 24 — All of my packages on npm have migrated to use environment-scoped staged publishing triggerable only by workflow_dispatch. This means 2FA is always required, so even if (god forbid) an npm or GitHub token is compromised, it will not be possible for the attacker to publish new versions.
So at least that's good to see. It would be nice for them to actually remove the commit from git history, though...
> EDIT Sept 24 — All of my packages on npm have migrated to use environment-scoped staged publishing triggerable only by workflow_dispatch. This means 2FA is always required, so even if (god forbid) an npm or GitHub token is compromised, it will not be possible for the attacker to publish new versions.
So at least that's good to see. It would be nice for them to actually remove the commit from git history, though...