1. Keep human control
   After reading the post-mortem of the npm-debacle, one takeaway stands out to me: we should avoid letting CI automatically update packages and dependencies. Keeping this as a manual step—with 2FA—adds a valuable layer of control. It’s a bit like the stock market: crashes sometimes happen when automated systems react blindly to one another’s signals.

2. Don’t trust humans (yourself)
   Earlier this month, Josh Junon was targeted by a successful phishing attack. While we don’t have full details—such as whether a password manager was in use—it’s notable that the phishing domain (npmjs[.]help) was a clear lookalike. A good password manager would typically flag this, which raises the possibility that one wasn’t used or its warning was ignored. Both could have been prevented and, imho, should have due to the sizes of the packages install base.

3. The way forward!
   The BEAM ecosystem currently lacks some critical safeguards that could help prevent these types of incidents. That’s why investing in the development of stronger tools and practices is not just important—it’s essential as clearly stated in the linked post.

4. In the meantime
   In the meantime, let’s stay vigilant, support one another, and make security a shared responsibility.

Lookout fir yourself aaand each other - Jerry Springer.

That’s not really the thing I would like people to take from this. Having the possibility that CI’s can publish makes a lot of sense, but only if done right. (Release Environments in GH for example so that only select jobs triggered by the right people get access).

I for sure prefer a clean CI setup over a large project handing out control to a lot of people.

One other way is to force WebAuthn based 2FA for all package maintainers. WebAuthn will not work on any domain.

Why not allow CI to build/upload new package versions but then add an additional (browser) 2FA step to “publish” the new version? That way a compromised API token would be much less dangerous but you still get the benefits of CI.

Keep in mind that building on developer machines offers no security benefit here. A lot of these attacks have actually targeted developer machines. It’s only the 2FA step that matters.

A great first step would be to support WebAuthn 2FA at all.