That’s interesting… I hadn’t equated the rise of supply chain vulnerabilities with a decline in interest in package management…

That said I’m in a role that hasn’t gone hog to the wall for AI vibe coded slop so… that might be why.

I wonder what the future for security scanners looks like when they can no longer just flag individual packages

Good question and I’m curious to hear the answer as well

I mean, so long as it remains configurable and they don’t change the entire project. I don’t see an issue with giving folks the option to mask the name in environments where they might not want to attract anyone’s ire.