UNFINISHED WORK IN PACKAGE SECURITY

Summary from the TLDR Dev newsletter

Package security still leaves consumers to verify that cooldowns and install restrictions actually work, control build permissions and promotion paths, and track dependencies beyond application lockfiles.